Overview

overview

8

Static

static

bc6ea3e906...1a.exe

windows7-x64

8

bc6ea3e906...1a.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    157s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 07:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe

  • Size

    412KB

  • MD5

    09128909376c75f71f2b0a8a009d834f

  • SHA1

    f664a49af4dd77a43b569c03b97442cbb71033f6

  • SHA256

    bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a

  • SHA512

    1ea8f01a18b3111f2c2e3302fadd423058c8f79e4071bfbc873047ee7f4a0c2dcdaa9d9228e35a78484f8b1f4bab8b70eb76400e21b9685017c669701a9825e7

  • SSDEEP

    6144:g8f6p0X4qumAxSRLnoPhL20gKc1ilJPZNkCLNr3Kr/u2x58uncuCKWYyYCcFV4ry:qp06UI9gKcaLLSdCKqYCemfxDIz

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe
    "C:\Users\Admin\AppData\Local\Temp\bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2276
    • \??\c:\program files\Realplayer\Swedish\commandline.exe
      "c:\program files\Realplayer\Swedish\commandline.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Realplayer\Swedish\commandline.exe
    Filesize

    412KB

    MD5

    7bcc24b0bb1256c969a12c6e5f8db904

    SHA1

    f738e2432ea275ce1e2980584821857a99ac817d

    SHA256

    b8a0e0a57f3b8bbdae2baaccc8058f9527a4178ce6cd0f92de86a650a8bf094c

    SHA512

    05e6bd76c81d0dec69a720e45aa189c654e8a6caba7ee084c9711cff54bc8f215fb0bb90740ee59e3775398f06d63362ca0bb14650b0210bea2b9254a8ea424d

    Download Submit

  • \??\c:\program files\Realplayer\Swedish\commandline.exe
    Filesize

    412KB

    MD5

    7bcc24b0bb1256c969a12c6e5f8db904

    SHA1

    f738e2432ea275ce1e2980584821857a99ac817d

    SHA256

    b8a0e0a57f3b8bbdae2baaccc8058f9527a4178ce6cd0f92de86a650a8bf094c

    SHA512

    05e6bd76c81d0dec69a720e45aa189c654e8a6caba7ee084c9711cff54bc8f215fb0bb90740ee59e3775398f06d63362ca0bb14650b0210bea2b9254a8ea424d

    Download Submit