Overview

overview

7

Static

static

7

a17019b4d6...25.exe

windows7-x64

7

a17019b4d6...25.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    189s
  • max time network
    201s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 10:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a17019b4d624a8bbfe80235883500d5dfa66ffb63432628c4800b25fb5712725.exe

  • Size

    656KB

  • MD5

    24f01f958906e3edcacb181c1e9870c4

  • SHA1

    0e9d526ff8f048d632149f4db4c3b8b5b530ab76

  • SHA256

    a17019b4d624a8bbfe80235883500d5dfa66ffb63432628c4800b25fb5712725

  • SHA512

    bd65f11596fcf03c83e4f42b566bf01deca2adf98a24ca881383fe07b6148707fc3674b0d3a06987b7bf869bd783ef5a3aef376f9595fdfb48be08249f9f4955

  • SSDEEP

    12288:dXg/+79LUCkI7qLwUa5q/5irZavKiyaM/d/XXCvINXHx1ZAkR:3LGIekb5Qnyi65NXRzbR

Score
7/10
evasionthemida

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida

Processes

  • C:\Users\Admin\AppData\Local\Temp\a17019b4d624a8bbfe80235883500d5dfa66ffb63432628c4800b25fb5712725.exe
    "C:\Users\Admin\AppData\Local\Temp\a17019b4d624a8bbfe80235883500d5dfa66ffb63432628c4800b25fb5712725.exe"
    1⤵
    • Identifies Wine through registry keys
    PID:3044

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3044-132-0x0000000000400000-0x000000000056D000-memory.dmp

    Filesize

    1.4MB

    Download