Analysis
-
max time kernel
11s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 21:55
Static task
static1
Behavioral task
behavioral1
Sample
c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe
Resource
win10v2004-20220812-en
General
-
Target
c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe
-
Size
489KB
-
MD5
79cba0a2f0bb95619cf3d39c7f370f2a
-
SHA1
501e9be190d9b51a5e8e66ef77140599326db57f
-
SHA256
c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4
-
SHA512
419b5df7d27700ac9030095f6cf23d7c42f7475cae57ab2c0d564afe4d23b0734eb0bfbd46d1a3db0b72db6b5e2a461ed38c5c8bac95f85ac563234119a5ca0d
-
SSDEEP
6144:Cso5EVzdMvxP7+6qX9pZm+Ev5XZfvH2BbsZT5l8Ozi8ZNVrrJ0WZmZz3yRp+BoUP:YEbsZT5l8OBZ7vJNbpbnP4zkI4zkJ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1000 c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Wplugin.dll c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe File opened for modification C:\Windows\Wplugin.dll c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe File created C:\Windows\explorer.exe.local c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe File created C:\Windows\ws2help.dll c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe File opened for modification C:\Windows\ws2help.dll c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1000 c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe"C:\Users\Admin\AppData\Local\Temp\c2926fe70e9cc6209df0f183e8a70938351a29b5afd2143a66d34383fc8de2e4.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1000
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD58847a8302dacc1d6fca61f125c8fe8e0
SHA1f399142bbf03660bee1df555ebbf3acc8f658cf0
SHA2569c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943
SHA5122b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f