Analysis
-
max time kernel
191s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
01-10-2022 21:31
General
-
Target
ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd.exe
-
Size
3.1MB
-
MD5
5f765eee8482e0aa6d22dbd636e743d7
-
SHA1
29b17065b28763c7b464bc30077ffc9441feae45
-
SHA256
ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd
-
SHA512
41d3c379c444cb0d0f7189585cb927090c02035c1c6f20ee6da0864130ba1d675a273c49c00d9d353d78ee435b368d52225170e55d998953b3f1142aa4164f28
-
SSDEEP
49152:mBEhaAKIT0yjox5za99WrhPCqN69x526qvsPIdCV7LGDOvhAyGWv4uAcZ6e7ur3:3365za99W5k9/zwCVdNG020W
Malware Config
Signatures
-
r77
r77 is an open-source, userland rootkit.
-
r77 rootkit payload 2 IoCs
Detects the payload of the r77 rootkit.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd.exe"C:\Users\Admin\AppData\Local\Temp\ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a.exeC:\Users\Admin\AppData\Local\Temp\\a.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD575af6cf8ac44a8dc4136ea679c292511
SHA174c7b0327d5fa311dbbfc9658965326507162c29
SHA256539304ee93b2f6872d2474d7a217986864f82e0acfd8f1a73fb8d303ec6e72f1
SHA512ff53a23d32ae9da3fc19c1ba84dcf2146e1c63c20c8d53cc51281f0588b8e91101d102bd536d822c1b1e2578d7b7ce7007d364e7a4737ba135a4c66343df78e8
-
Filesize
1.2MB
MD575af6cf8ac44a8dc4136ea679c292511
SHA174c7b0327d5fa311dbbfc9658965326507162c29
SHA256539304ee93b2f6872d2474d7a217986864f82e0acfd8f1a73fb8d303ec6e72f1
SHA512ff53a23d32ae9da3fc19c1ba84dcf2146e1c63c20c8d53cc51281f0588b8e91101d102bd536d822c1b1e2578d7b7ce7007d364e7a4737ba135a4c66343df78e8
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
200KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB