Analysis
-
max time kernel
61s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2023 23:15
Behavioral task
behavioral1
Sample
sotema_5.txt.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
General
-
Target
sotema_5.txt.exe
-
Size
773KB
-
MD5
51e7f03ae54c977764c32b0dedf0b9ac
-
SHA1
03cf8e81b1b8a96097c9e3da11f925e7dc6819b7
-
SHA256
0580678f81e9801e3678c5d4cf1cfe674aa52ce95092e67908d6a7d4192a429b
-
SHA512
03ea4d2dd652c3fd858c54cf579c410a12c7296acf222ebad57bcfaea33b71fc411122bc35a7b8ff56cb0254e42a6042fbe6efdb47a97ba61fb6ed15c9931661
-
SSDEEP
24576:Wu/phBzW6ZEaA9Wip9TPP+szWC7SORTwrGKcq:LhzJG6E3TCGVq
Malware Config
Signatures
-
Processes:
sotema_5.txt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sotema_5.txt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sotema_5.txt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" sotema_5.txt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection sotema_5.txt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sotema_5.txt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sotema_5.txt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sotema_5.txt.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 ipinfo.io 30 ipinfo.io