Overview

overview

10

Static

static

7

be27a45e35...fb.exe

windows7-x64

10

be27a45e35...fb.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    112s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 07:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe

  • Size

    995KB

  • MD5

    fec2f67c261edfb07ae184e163317704

  • SHA1

    56edabab5646c6d9316879396013550b87b54f85

  • SHA256

    be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb

  • SHA512

    2759b059544ba5b3c7d89c025f2552bed434b5405cbfb8ecff240d2b389295b423d08fc238842b4509590bad1bad8bc25d1e1442a0344f757d4d9601e7c75670

  • SSDEEP

    24576:Ws3RNNThFOfRDt0x62p0DJChree1tog5uQoDb0:WShFet0x62SD2I0

Score
7/10
evasionthemida

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida

Processes

  • C:\Users\Admin\AppData\Local\Temp\be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe
    "C:\Users\Admin\AppData\Local\Temp\be27a45e352c4a50badc4aed1f008bc5d40308622abc132a56569251014563fb.exe"
    1⤵
    • Identifies Wine through registry keys
    PID:2308

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2308-132-0x0000000000400000-0x00000000005D3000-memory.dmp

          Filesize

          1.8MB

          Download