Analysis
-
max time kernel
133s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 00:13
Static task
static1
Behavioral task
behavioral1
Sample
38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe
Resource
win10v2004-20220812-en
General
-
Target
38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe
-
Size
506KB
-
MD5
ba84fdc8b7e5d606bc24f7bd7bede19d
-
SHA1
42e34bc4bed1463b3ba43fec8d51725f9bb851e9
-
SHA256
38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8
-
SHA512
30ee50e9bf8423b36d795b1ce98bb47f369ff30a8ab91c3857d64ea1ec30ff9ab9970fa777ac618a1b907a2268fadce59b2ea44588362c14999fbfd1e40b3e56
-
SSDEEP
6144:xqtSTmIejn6HD9OloWQYO5KWpwtt9/pKDSJ1QjsYMbGByo6QrsFIcF5M/QxhR/W2:xwSTmTn6jQifC5kSmTzKRoiHGk
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2988 1664 38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe 82 PID 1664 wrote to memory of 2988 1664 38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe 82 PID 1664 wrote to memory of 2988 1664 38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe 82 PID 1664 wrote to memory of 1556 1664 38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe 83 PID 1664 wrote to memory of 1556 1664 38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe 83 PID 1664 wrote to memory of 1556 1664 38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe"C:\Users\Admin\AppData\Local\Temp\38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exestart2⤵PID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exewatch2⤵PID:1556
-
Network
-
Remote address:8.8.8.8:53Requestforces.info-elka.ruIN AResponse
-
Remote address:8.8.8.8:53Requestforces.info-elka.ruIN AResponse
-
Remote address:8.8.8.8:53Requestforces.info-elka.ruIN AResponse
-
Remote address:8.8.8.8:53Requestforces.info-elka.ruIN AResponse
-
Remote address:8.8.8.8:53Requestforces.info-elka.ruIN AResponse
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
8.8.8.8:53forces.info-elka.rudns38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe130 B 252 B 2 2
DNS Request
forces.info-elka.ru
DNS Request
forces.info-elka.ru
-
8.8.8.8:53forces.info-elka.rudns38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe130 B 252 B 2 2
DNS Request
forces.info-elka.ru
DNS Request
forces.info-elka.ru
-
8.8.8.8:53forces.info-elka.rudns38fbd07d8bb79b6060a8c27c03b52088518ff7165565d0f36605634f190771c8.exe65 B 126 B 1 1
DNS Request
forces.info-elka.ru