f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd

Analysis

max time kernel
151s
max time network
134s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
Size

249KB
MD5

58036f57da89d81c64a30d281b6b6443
SHA1

3c00e9c326d8e058bae5f777101b48cf8686ad91
SHA256

f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd
SHA512

aebf2b2425d8265517ff676a6e199fccd287016352df54e23349bfff3b973d5fdf31a53da678c70e17692eba45f334ceb61f338af6a09ce000db40cb1ffdf743
SSDEEP

6144:+XYryzuMEUbWG+t3EXyJ/CGBBYLWpXqtTB6NIM:+XY2uMEUb5VCVC3eqtTg

Score

7^/10

Malware Config

Signatures

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	35.205.61.67

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
1368	f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe

C:\Users\Admin\AppData\Local\Temp\f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe
"C:\Users\Admin\AppData\Local\Temp\f05de2e95c40be7165673f1b21bf25528792abcec5e08438ff825146bf186acd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download