Analysis
-
max time kernel
41s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/05/2023, 20:09
Behavioral task
behavioral1
Sample
Runtime (Abri isso antes de abrir o Extreme Injector).exe
Resource
win7-20230220-en
General
-
Target
Runtime (Abri isso antes de abrir o Extreme Injector).exe
-
Size
9.6MB
-
MD5
093ab8b625eb6fd14801118e87fa4eae
-
SHA1
1c33569c599d47d568a25caa794b01832b0f5b6f
-
SHA256
4723dcde8ad6d450408d31539b416879a5d525e5ed87a81387b37370e39b33a0
-
SHA512
1e7e1e655760b6540447edcf95ab26bb597492a8718a91c0c6dcea2b731521a00057af40f4502b9add4c30f070d656d7cfc20d9740aa331e0a597b4c51e933fd
-
SSDEEP
196608:EuyL9HLAlnfih8FwjxHSRHvUWvozhx0PuqLQbRLXtg/4MNUt8wNT3c:UxAlnfLFHRHd2x0u+QbClN27
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 992 Runtime (Abri isso antes de abrir o Extreme Injector).exe -
resource yara_rule behavioral1/files/0x0006000000014fb5-131.dat upx behavioral1/files/0x0006000000014fb5-132.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1460 wrote to memory of 992 1460 Runtime (Abri isso antes de abrir o Extreme Injector).exe 28 PID 1460 wrote to memory of 992 1460 Runtime (Abri isso antes de abrir o Extreme Injector).exe 28 PID 1460 wrote to memory of 992 1460 Runtime (Abri isso antes de abrir o Extreme Injector).exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Runtime (Abri isso antes de abrir o Extreme Injector).exe"C:\Users\Admin\AppData\Local\Temp\Runtime (Abri isso antes de abrir o Extreme Injector).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\Runtime (Abri isso antes de abrir o Extreme Injector).exe"C:\Users\Admin\AppData\Local\Temp\Runtime (Abri isso antes de abrir o Extreme Injector).exe"2⤵
- Loads dropped DLL
PID:992
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5fe730faa642713f53be7423421cf3273
SHA1b31588980a40f4fc45c5deb51869d850d1490da1
SHA256de05a58247136d07970b5d3a0582143833e397abfb9ba22e36fcae99f4c7c66d
SHA512ab11100259a5b81a8c424f2ea47886ca821bad1128973fd4bc068f9f46b4000f54793edb2dcb596e63616bb45e88b30ea129100225685c17ed36ca6b238c37bf
-
Filesize
1.4MB
MD5fe730faa642713f53be7423421cf3273
SHA1b31588980a40f4fc45c5deb51869d850d1490da1
SHA256de05a58247136d07970b5d3a0582143833e397abfb9ba22e36fcae99f4c7c66d
SHA512ab11100259a5b81a8c424f2ea47886ca821bad1128973fd4bc068f9f46b4000f54793edb2dcb596e63616bb45e88b30ea129100225685c17ed36ca6b238c37bf