357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57

Analysis

max time kernel
145s
max time network
134s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
Size

229KB
MD5

49f55bb90e027e1cd6fe7518c078f78c
SHA1

d9e936948565cb5e77d0f26eb911626b597d2bb1
SHA256

357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57
SHA512

55725d468e94cf75f0c5ee4a0a8395a29e6bc863e2e571c669da2103204b9d1ea1e9007a99ba173315fcc14b9ef9f243611d1b1868a89969407eacf556333983
SSDEEP

6144:DaWlHgUauD9xKLz0QYsrYO0PoNTdh/cOz9JobneqtTBrXP:zAUlD9xKEQJYrITd9cTDeqtTV

Score

7^/10

Malware Config

Signatures

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	35.205.61.67

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
1064	357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe

C:\Users\Admin\AppData\Local\Temp\357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe
"C:\Users\Admin\AppData\Local\Temp\357a8cbbabaad6f677f2a9a6783ef415a53201b06296e2c184d8f9ea55927b57.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download