Analysis
-
max time kernel
30s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2022 12:32
Static task
static1
Behavioral task
behavioral1
Sample
8aad45af9160c2ca8bd362c31dd37bf109766a96a9cacecb1aa848ce5d85f7c9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8aad45af9160c2ca8bd362c31dd37bf109766a96a9cacecb1aa848ce5d85f7c9.exe
Resource
win10v2004-20220812-en
General
-
Target
8aad45af9160c2ca8bd362c31dd37bf109766a96a9cacecb1aa848ce5d85f7c9.exe
-
Size
255KB
-
MD5
e3fa0d3cca9be11d133a560602deb27c
-
SHA1
fbb90eb23a4457c24dbbcd05ee500ba2688e606a
-
SHA256
8aad45af9160c2ca8bd362c31dd37bf109766a96a9cacecb1aa848ce5d85f7c9
-
SHA512
aff7733b9493edac158329663df337cc6a7ee9c7c8b8630cc15d4c3d7d7dfaca64472480dc6d8f743b117cb5cf369c7f6e2d1b95efae63d94a25d4116080ee6b
-
SSDEEP
3072:H8Lrufos9CJ3VqDH32GhNvozescJepkvAvOoRKONOG1:sB4L2GhN7ZkkvAvOoRK
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4760 netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8aad45af9160c2ca8bd362c31dd37bf109766a96a9cacecb1aa848ce5d85f7c9.exe"C:\Users\Admin\AppData\Local\Temp\8aad45af9160c2ca8bd362c31dd37bf109766a96a9cacecb1aa848ce5d85f7c9.exe"1⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵PID:532
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:4760
-
-
Network
-
Remote address:8.8.8.8:53Requestabdelghani12.ddns.netIN AResponse
-
Remote address:8.8.8.8:53Requestabdelghani12.ddns.netIN A
-
Remote address:8.8.8.8:53Requestabdelghani12.ddns.netIN AResponse
-
40 B 1
-
92 B 80 B 2 2
-
322 B 7
-
322 B 7
-
276 B 6
-
230 B 5
-
230 B 5
-
230 B 5
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD52000a79c9b494bc08c9d7d643847ceb0
SHA148f607779b3f258473c7298633bfd72a8558ad07
SHA2568495470ac059f8d1772a6b89a6b56a704bc97666f8f9fee121dd477bde7ab83a
SHA512af92415b890a7a1cfdeed314d15bf0cd61d6c465148d56325fe9050d3e592520a832daee08c6f78711ad38cb01b9c4fe485eaabb4e3b5ed962a010e821a359b1
-
Filesize
25KB
MD583605429da541462328690edeeef4376
SHA19f7ea4e0a7d5d15660eef49041c3ccb699fde3cd
SHA256ef003611616712c311d779c8c8dc3d2a0a9d48a8572671c9d9bd98dbf517628e
SHA512d7a410dce1327b810f84ead5184032a1195edb6fe0d9141d9b97f2feba7a7881599ed68f12ba9bd07260f66aff4f825e2b44dfed996240280b771a18be3f0e18