Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:58
Static task
static1
Behavioral task
behavioral1
Sample
5386418c42b84b7d5da9dfa6b74c6134745e30e385fa605cd82ad443c5514bab.exe
Resource
win7-20220901-en
General
-
Target
5386418c42b84b7d5da9dfa6b74c6134745e30e385fa605cd82ad443c5514bab.exe
-
Size
164KB
-
MD5
4307333ad6c1221bc40ef92b5641e410
-
SHA1
cdd831b95b3c36a16c4c2c713639557f2180b142
-
SHA256
5386418c42b84b7d5da9dfa6b74c6134745e30e385fa605cd82ad443c5514bab
-
SHA512
da40162dcd1f1e50e3b5bfa441a779bef56b2996ceec788f37520d7cd1bca9586f9a965f9b2b39dab66c61f9afbd28e4bd95616e441abf6df55ce4456ab967ee
-
SSDEEP
3072:YkT6zOA0mX1K/dnAFGvKsAisPd90qoF3L0Db0/5Eurwg4nlL5q7pf:BGhK/7VsPUv3QDb0hxww7pf
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1716-132-0x0000000002330000-0x0000000003361000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5008 1716 WerFault.exe 5386418c42b84b7d5da9dfa6b74c6134745e30e385fa605cd82ad443c5514bab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5386418c42b84b7d5da9dfa6b74c6134745e30e385fa605cd82ad443c5514bab.exe"C:\Users\Admin\AppData\Local\Temp\5386418c42b84b7d5da9dfa6b74c6134745e30e385fa605cd82ad443c5514bab.exe"1⤵PID:1716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 5762⤵
- Program crash
PID:5008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1716 -ip 17161⤵PID:4252