Analysis
-
max time kernel
234s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 06:57
Behavioral task
behavioral1
Sample
81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe
Resource
win7-20221111-en
windows7-x64
2 signatures
150 seconds
General
-
Target
81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe
-
Size
426KB
-
MD5
4c60f145b1f849f1c31d4948280735a4
-
SHA1
98e77cb1a0df22fee30bdc755a255585cee7be8f
-
SHA256
81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52
-
SHA512
33a0a65b0e9537051205a2088bc44323b549afb240534d0319a50c4874bd8d73fed13cf1f5cf592ce952d1b256b4ea40f1a97e63ae00cb0cf24c978c7f13db03
-
SSDEEP
6144:aw1R8uK7CWmhvAXtAiKkgsaGZ7m/kJKr53+LZRL+9adg5gN+p5J7eEw3/tno:2HA5VGlGnwXC8+5pLeEg/tno
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
Processes:
81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exedescription ioc process File opened for modification C:\Windows\system32\drivers\arcsas.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\drivers\dxgkrnl.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\intelide.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\nv_agp.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\DRIVERS\scfilter.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\speeder.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\DRIVERS\wanarp.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\1394ohci.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\Drivers\BrUsbSer.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\hidir.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\TsUsbGD.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\VMBusHID.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\vsmraid.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\DRIVERS\RDPCDD.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\adpahci.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\hidbth.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\sffdisk.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\drivers\discache.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\Drivers\NDProxy.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\aliide.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\sermouse.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\sisraid4.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\uliagpkx.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\Wdf01000.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\amdide.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\BrFiltLo.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\SiSRaid2.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\isapnp.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\drivers\rdpvideominiport.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\wacompen.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\iirsp.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\lsi_sas2.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\MTConfig.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\vmbus.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\agp440.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\amdppm.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\flpydisk.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\sbp2port.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\storvsc.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\usbohci.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\lsi_sas.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\MSKSSRV.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\Drivers\Null.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\CmBatt.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\dmvsc.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\Drivers\RDPWD.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\ql40xx.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\serenum.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\DRIVERS\lltdio.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\DRIVERS\rspndr.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\bxvbda.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\BrFiltUp.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\mpio.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\drmkaud.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\DRIVERS\ndisuio.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\processr.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\pciide.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\amdsata.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\elxstor.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\parport.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\System32\DRIVERS\rasacd.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\terminpt.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\DRIVERS\b57nd60a.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe File opened for modification C:\Windows\system32\drivers\msdsm.sys 81836f9ecd208c11d37b5cbda9e70263a56d0cca4b539d6bfc128103bab1ea52.exe -
Processes:
resource yara_rule behavioral1/memory/468-54-0x0000000000400000-0x00000000004B9000-memory.dmp vmprotect behavioral1/memory/468-56-0x0000000000400000-0x00000000004B9000-memory.dmp vmprotect