Overview

overview

7

Static

static

d616feeb1c...fe.exe

windows7-x64

7

d616feeb1c...fe.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    92s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 06:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d616feeb1c8b5387ad49eae70285cfc7a252607ad2efb2019dc804df3fca9bfe.exe

  • Size

    28KB

  • MD5

    ac5b960528ef687e6bf07ab486b2ff79

  • SHA1

    ec31f24c21d4f6ea968788ebf0c63d0c17379c12

  • SHA256

    d616feeb1c8b5387ad49eae70285cfc7a252607ad2efb2019dc804df3fca9bfe

  • SHA512

    42c6d91a29de87f1ef788a236af6952654926cfdfdb408dfcc9c780704682b0ac387740195a48b3e42cbc8622fd61026aeeccc93b446410aa195029343c67c9a

  • SSDEEP

    384:ueqtEesJaxsvQd035njBNw3Ml/oIXqgbilXLQ8AJMJfd7abZofCG/rEHzSHoj:grW35jBNw3MlTXpilXLQhJMXaduUzJ

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d616feeb1c8b5387ad49eae70285cfc7a252607ad2efb2019dc804df3fca9bfe.exe
    "C:\Users\Admin\AppData\Local\Temp\d616feeb1c8b5387ad49eae70285cfc7a252607ad2efb2019dc804df3fca9bfe.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\syswow64\svchost.exe"
      2⤵
        PID:4064

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3012-132-0x00000000005C0000-0x00000000005C3000-memory.dmp
      Filesize

      12KB

      Download
    • memory/3012-134-0x00000000005C0000-0x00000000005C3000-memory.dmp
      Filesize

      12KB

      Download
    • memory/4064-133-0x0000000000000000-mapping.dmp
      Download
    • memory/4064-135-0x0000000000F70000-0x0000000000F7E000-memory.dmp
      Filesize

      56KB

      Download
    • memory/4064-136-0x0000000000620000-0x0000000000623000-memory.dmp
      Filesize

      12KB

      Download