General
-
Target
1296-55-0x0000000000400000-0x0000000000470000-memory.dmp
-
Size
448KB
-
Sample
230426-b25e6sec63
-
MD5
8218697910932eafcc10a7e9fff1fd65
-
SHA1
5035057f427ccfb56bc7281d4ac7d20f9831ef59
-
SHA256
60ee3ae2cd355bd946e4eff89ca529753b90c874a3be699cad314f51decb8a89
-
SHA512
77bde99b419919bf9e82dbb9f637c8fa76f52d1def6c1479093d94562957fb1da2c07a6c21deb545b0dc054440746dff14a2d4083d22592d8821a71034491ce1
-
SSDEEP
6144:b2eQRB4TPIbjy4IwZDij1Qd6wOzWqG1Nwz7j42W3Llin:ORB4TPGDG1Y6wq1cwvjW3Un
Behavioral task
behavioral1
Sample
1296-55-0x0000000000400000-0x0000000000470000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1296-55-0x0000000000400000-0x0000000000470000-memory.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
netwire
forgiveme.workisboring.com:3360
-
activex_autorun
true
-
activex_key
{TN38RH36-U670-03U7-57DE-24XMTWQBHGH1}
-
copy_executable
true
-
delete_original
false
-
host_id
bendal
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
centosffjk
-
use_mutex
false
Targets
-
-
Target
1296-55-0x0000000000400000-0x0000000000470000-memory.dmp
-
Size
448KB
-
MD5
8218697910932eafcc10a7e9fff1fd65
-
SHA1
5035057f427ccfb56bc7281d4ac7d20f9831ef59
-
SHA256
60ee3ae2cd355bd946e4eff89ca529753b90c874a3be699cad314f51decb8a89
-
SHA512
77bde99b419919bf9e82dbb9f637c8fa76f52d1def6c1479093d94562957fb1da2c07a6c21deb545b0dc054440746dff14a2d4083d22592d8821a71034491ce1
-
SSDEEP
6144:b2eQRB4TPIbjy4IwZDij1Qd6wOzWqG1Nwz7j42W3Llin:ORB4TPGDG1Y6wq1cwvjW3Un
Score3/10 -