Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 10:20
Static task
static1
Behavioral task
behavioral1
Sample
d48be2b1286ad771ed91b7e11464813d.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d48be2b1286ad771ed91b7e11464813d.exe
Resource
win10v2004-20220414-en
colibridjvuredlinevidar122517build1discoveryinfostealerloaderpersistencepyinstallerransomwarespywarestealersuricataupx
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
d48be2b1286ad771ed91b7e11464813d.exe
-
Size
262KB
-
MD5
d48be2b1286ad771ed91b7e11464813d
-
SHA1
a7ed356cdb5143d3f3be37840294c199e00f0327
-
SHA256
5a398402a9490b25fa2d70a72aaf7a2ec72c933eac8c55a17e1140b40ca0e045
-
SHA512
f91523c48e82a1712a3884d06a9b7f6667e1488d99c771cedcea21c19234395ee599a3543ebdd13740c3ca2a185216d6bf17a30037f1582c2f6e048fb7026687
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d48be2b1286ad771ed91b7e11464813d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d48be2b1286ad771ed91b7e11464813d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d48be2b1286ad771ed91b7e11464813d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d48be2b1286ad771ed91b7e11464813d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d48be2b1286ad771ed91b7e11464813d.exepid process 1720 d48be2b1286ad771ed91b7e11464813d.exe 1720 d48be2b1286ad771ed91b7e11464813d.exe 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 1312 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
d48be2b1286ad771ed91b7e11464813d.exepid process 1720 d48be2b1286ad771ed91b7e11464813d.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1720-54-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/1720-55-0x0000000000B5B000-0x0000000000B6C000-memory.dmpFilesize
68KB
-
memory/1720-56-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1720-57-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB
-
memory/1720-58-0x0000000000400000-0x0000000000A73000-memory.dmpFilesize
6.4MB