Analysis
-
max time kernel
88s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 04:44
Behavioral task
behavioral1
Sample
0b8917479bd556c8b08c7a1116a69fe3775d09338111990cdda9b54832719c5a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0b8917479bd556c8b08c7a1116a69fe3775d09338111990cdda9b54832719c5a.exe
Resource
win10v2004-20220901-en
General
-
Target
0b8917479bd556c8b08c7a1116a69fe3775d09338111990cdda9b54832719c5a.exe
-
Size
98KB
-
MD5
6f5d6e4d71c035c688983f9e9de791ef
-
SHA1
533f647fbdcd67ab69069674fae241e374aa32a5
-
SHA256
0b8917479bd556c8b08c7a1116a69fe3775d09338111990cdda9b54832719c5a
-
SHA512
fc3b8c638019eef2e36d1677046907f88a88595781664898fd577347232a18519d879661adea4c19b62657f008871fc87a3aa4caf7905b431e35dd6e49828f48
-
SSDEEP
1536:WOD8zCt4c/PbZtAt/KJyIsyUp0HbcKcS4MTZE9WSXigjI2ie+1c3iy5Zb6ay/GJB:dSnMtAy9sjIoXlyMIA+hy5R6H/WEAj
Malware Config
Signatures
-
Detected Xorist Ransomware 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2320-132-0x0000000000400000-0x000000000041E000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4248 2320 WerFault.exe 0b8917479bd556c8b08c7a1116a69fe3775d09338111990cdda9b54832719c5a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b8917479bd556c8b08c7a1116a69fe3775d09338111990cdda9b54832719c5a.exe"C:\Users\Admin\AppData\Local\Temp\0b8917479bd556c8b08c7a1116a69fe3775d09338111990cdda9b54832719c5a.exe"1⤵PID:2320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 3602⤵
- Program crash
PID:4248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2320 -ip 23201⤵PID:1104