Overview

overview

10

Static

static

10

21ce7f24f0...d7.exe

windows7-x64

7

21ce7f24f0...d7.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    66s
  • max time network
    89s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2022 11:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    21ce7f24f0e596f642e65af75cbe1935270576f981454d8ce72c7cfeb711bfd7.exe

  • Size

    4.5MB

  • MD5

    9e762fc004ec2bcf72b68b1837d24d7c

  • SHA1

    82347642ae91240f6ff6a692671f4270cf7b8202

  • SHA256

    21ce7f24f0e596f642e65af75cbe1935270576f981454d8ce72c7cfeb711bfd7

  • SHA512

    fe55c540235ae4956999281e8abf0b83ea6bb7ede11be2e6ffcc21fd6df9f64cd6e1d3155194cab5f908723a6b0747ae6701095b9e617d007241517132ade43d

  • SSDEEP

    98304:a3xbP+shEo2uNd6nVNMp9VeEQQExLE0DCZFOs:at+L5YwiTV3t0D0F

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21ce7f24f0e596f642e65af75cbe1935270576f981454d8ce72c7cfeb711bfd7.exe
    "C:\Users\Admin\AppData\Local\Temp\21ce7f24f0e596f642e65af75cbe1935270576f981454d8ce72c7cfeb711bfd7.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\wluxgypvbepybrtjyom.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\system32\sc.exe
        SC QUERY
        3⤵
        • Launches sc.exe
        PID:932
      • C:\Windows\system32\findstr.exe
        FINDSTR SERVICE_NAME
        3⤵
          PID:1440
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\sxlnhqvaielfufkblgjd.bat
        2⤵
          PID:1516

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\wluxgypvbepybrtjyom.bat
        Filesize

        43B

        MD5

        55310bb774fff38cca265dbc70ad6705

        SHA1

        cb8d76e9fd38a0b253056e5f204dab5441fe932b

        SHA256

        1fbdb97893d09d59575c3ef95df3c929fe6b6ddf1b273283e4efadf94cdc802d

        SHA512

        40e5a5e8454ca3eaac36d732550e2c5d869a235e3bbc4d31c4afa038fe4e06f782fa0885e876ad8119be766477fdcc12c1d5d04d53cf6b324e366b5351fc7cd4

        Download Submit