Overview

overview

10

Static

static

10

35683ac5bb...ed.exe

windows7-x64

8

35683ac5bb...ed.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    600s
  • max time network
    603s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2022 21:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    35683ac5bbcc63eb33d552878d02ff44582161d1ea1ff969b14ea326083ea780_unpacked.exe

  • Size

    96KB

  • MD5

    e44cfd6ecc1ea0015c28a75964d19799

  • SHA1

    cb294c79b5d48840382a06c4021bc2772fdbcf63

  • SHA256

    52e72513fe2a38707aa63fbc52dabd7c7d2c5809ed7e27f384315375426f57bf

  • SHA512

    89ec1c96d90991fcc691a461e64631f5f9d970a90560cf5143685a2f2b6c3afeda84fe38500003f303dc1cb35876fda03aeac29745d30cc397509751d8a96835

  • SSDEEP

    1536:7X4kTvTOqjai7Z/ZP1FOsXO4dvhvMdAX0pJ0P11XJ2H1:7X4kL5f/OgO4dZvMdO0pWP11XM1

Score
8/10

Malware Config

Signatures

  • Tries to connect to .bazar domain 64 IoCs

    Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35683ac5bbcc63eb33d552878d02ff44582161d1ea1ff969b14ea326083ea780_unpacked.exe
    "C:\Users\Admin\AppData\Local\Temp\35683ac5bbcc63eb33d552878d02ff44582161d1ea1ff969b14ea326083ea780_unpacked.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads