Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:08
Behavioral task
behavioral1
Sample
d1a83529af2320a3defd1abedbf4e1315174a0af0586bd14eae8e23c52ca2e1d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d1a83529af2320a3defd1abedbf4e1315174a0af0586bd14eae8e23c52ca2e1d.exe
Resource
win10v2004-20220812-en
General
-
Target
d1a83529af2320a3defd1abedbf4e1315174a0af0586bd14eae8e23c52ca2e1d.exe
-
Size
62KB
-
MD5
44784b679fe61ddcbefc1349c16c7080
-
SHA1
b1cb96cbf2f9ed28465d176c1e4f4f67a0cc2822
-
SHA256
d1a83529af2320a3defd1abedbf4e1315174a0af0586bd14eae8e23c52ca2e1d
-
SHA512
f4118deba7bea0cbcfea5cc1cd35cf0ef53343334ac94a19486e4db7cec1d215377d19c0bf64ae6618edfa5208f2a5202d33836a5b43bbaefcd57eed2fd1d5af
-
SSDEEP
1536:MHoSCdeVMCT6ggMw4Y7FgG2xV89mTr39w6XJJzVt/2vO:MHoLde/OgV432UcP39hXJZn/z
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Processes:
resource yara_rule behavioral1/memory/1976-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-56-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
d1a83529af2320a3defd1abedbf4e1315174a0af0586bd14eae8e23c52ca2e1d.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Wqk.dll d1a83529af2320a3defd1abedbf4e1315174a0af0586bd14eae8e23c52ca2e1d.exe File created C:\Windows\SysWOW64\Wqk.dll d1a83529af2320a3defd1abedbf4e1315174a0af0586bd14eae8e23c52ca2e1d.exe -
Drops file in Windows directory 1 IoCs
Processes:
d1a83529af2320a3defd1abedbf4e1315174a0af0586bd14eae8e23c52ca2e1d.exedescription ioc process File created C:\Windows\dextor32.exe d1a83529af2320a3defd1abedbf4e1315174a0af0586bd14eae8e23c52ca2e1d.exe