Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 11:07
Behavioral task
behavioral1
Sample
e537e89d31d7a4ff6d93d7822263535090fdfd5e6fe9997a2238c00d08d9e40d.exe
Resource
win7-20230220-en
General
-
Target
e537e89d31d7a4ff6d93d7822263535090fdfd5e6fe9997a2238c00d08d9e40d.exe
-
Size
2.4MB
-
MD5
8c3dd58f0ae830da072858d3b875c194
-
SHA1
328df464d6464f187005fc3a04ad81a225afc8d1
-
SHA256
e537e89d31d7a4ff6d93d7822263535090fdfd5e6fe9997a2238c00d08d9e40d
-
SHA512
7f72a9665ba7a2ecedc0c313616e83c504b91f7cdad565e785347df9070fee2a72370087183aaa92cd759da36849a37ed7cc21b676d4fbf36adc41ee2044c52e
-
SSDEEP
49152:/owKvLLXCD4cStcZwzPo7SW4XXWE5klZFgGwQqwBDMTn5zJS+DLrSUFIC:ZKvLrZntcZ57SW4HWE6Dt1DMtz4+D3Fp
Malware Config
Signatures
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
e537e89d31d7a4ff6d93d7822263535090fdfd5e6fe9997a2238c00d08d9e40d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Wine e537e89d31d7a4ff6d93d7822263535090fdfd5e6fe9997a2238c00d08d9e40d.exe -
Processes:
resource yara_rule behavioral2/memory/4732-133-0x0000000000400000-0x00000000008AF000-memory.dmp themida behavioral2/memory/4732-136-0x0000000000400000-0x00000000008AF000-memory.dmp themida
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4732-133-0x0000000000400000-0x00000000008AF000-memory.dmpFilesize
4.7MB
-
memory/4732-134-0x0000000002670000-0x0000000002754000-memory.dmpFilesize
912KB
-
memory/4732-135-0x0000000000E80000-0x0000000000E81000-memory.dmpFilesize
4KB
-
memory/4732-136-0x0000000000400000-0x00000000008AF000-memory.dmpFilesize
4.7MB