Analysis
-
max time kernel
166s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 06:54
Behavioral task
behavioral1
Sample
81fa3ab70e5c7995e2b0816d25d7fa03587b101bb32dee51cd6a10272ee680fb.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
General
-
Target
81fa3ab70e5c7995e2b0816d25d7fa03587b101bb32dee51cd6a10272ee680fb.exe
-
Size
815KB
-
MD5
39d502ce5ce86a323beae3b4d21c3510
-
SHA1
9dae0017e0b4a6b0c84b283b1e4d59637d40b380
-
SHA256
81fa3ab70e5c7995e2b0816d25d7fa03587b101bb32dee51cd6a10272ee680fb
-
SHA512
d70ed3df0cbc4fa5a39a5fc978c56a77048b546222a65aec62cd9b09eb37fca1ca66dd0996c2e97651bc408fa901512a97524826226056ae6101626a9d5809a0
-
SSDEEP
24576:mAbEuC50en8G+4Q/CzxOp5LCrVxrf3VlUpVbacw:V9e8GbskxO/SrwpVd
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
81fa3ab70e5c7995e2b0816d25d7fa03587b101bb32dee51cd6a10272ee680fb.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Wine 81fa3ab70e5c7995e2b0816d25d7fa03587b101bb32dee51cd6a10272ee680fb.exe -
Processes:
resource yara_rule behavioral2/memory/2616-132-0x0000000000400000-0x00000000005CB000-memory.dmp themida
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2616-132-0x0000000000400000-0x00000000005CB000-memory.dmpFilesize
1.8MB