Analysis
-
max time kernel
151s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 21:31
Static task
static1
Behavioral task
behavioral1
Sample
c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e.exe
Resource
win10v2004-20220812-en
General
-
Target
c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e.exe
-
Size
976KB
-
MD5
6b9b69e761a41dadcc0adf3b63a43a3c
-
SHA1
3835417599394198e15c474174dbc2a4b82c5aac
-
SHA256
c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e
-
SHA512
4bb478839a526c81659e210b77d0ea51356f8f3db25f051a9013856a64a50392ffcc5c1fa988cd6968038ef1daed7eba37382f48e7c63a413506f16e068d6e1d
-
SSDEEP
12288:v/5FWIEv6ZsSNobjXETyTcNgw7E+vGK/wiBnqAFTIMafJzq0QOvRn5a/3ikz16s7:H5FWv6NNobjET/rgfAws6Mabng5lunJc
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Wine c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e.exe