21973e7163034e17a0291f57910d8720078317c9546f4b406f9de9ef5ffc90aa

Analysis

max time kernel
135s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

l2.exe
Size

26.2MB
MD5

131ddb28f23ec31a095f7e04cac53646
SHA1

9aea97dbac5d239c3d39c01d2488cac5d394239e
SHA256

21973e7163034e17a0291f57910d8720078317c9546f4b406f9de9ef5ffc90aa
SHA512

1b44adcdf0df4a9d3feb64fc46ea936b5f6136bb6488c2bf3da9d1cfc8c5c5c5329c7616be6ac6a34e5d07db8e489546890efde0d7b671cdc7d88a45dd7618b3
SSDEEP

786432:8bA3yvmBC3EZYMnfUaab76sKmut/ax1CKucMOR:LA3E+HapsKmC/Q1CKeOR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4476	aaerrport.exe

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
996	l2.exe
996	l2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
996	l2.exe
996	l2.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

C:\Users\Admin\AppData\Local\Temp\l2.exe
"C:\Users\Admin\AppData\Local\Temp\l2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:996

C:\Users\Admin\AppData\Local\Temp\ActiveAnticheat\aaerrport.exe
C:\Users\Admin\AppData\Local\Temp\ActiveAnticheat\aaerrport.exe
1⤵
- Executes dropped EXE
PID:4476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ActiveAnticheat\aaerrport.exe

Filesize
221KB

MD5
9295ca172b8d5a8c75d880258321d8a1

SHA1
59139718dbdb7c07c0ac28517bc171697151fc7f

SHA256
032824b198387ecf0c2cb498d58e9c8674f32a19d6e605c3aef13f62129da374

SHA512
5bfa09b890125ae0a100aa6a06e42089386f08ffd9ac3584270ff3aaca80f8c75336b2faf90e16b212a3c834056b3ea4fdab9a0d0ca9e551d880976d2874d015

Download Submit
C:\Users\Admin\AppData\Local\Temp\ActiveAnticheat\aaerrport.exe

Filesize
221KB

MD5
9295ca172b8d5a8c75d880258321d8a1

SHA1
59139718dbdb7c07c0ac28517bc171697151fc7f

SHA256
032824b198387ecf0c2cb498d58e9c8674f32a19d6e605c3aef13f62129da374

SHA512
5bfa09b890125ae0a100aa6a06e42089386f08ffd9ac3584270ff3aaca80f8c75336b2faf90e16b212a3c834056b3ea4fdab9a0d0ca9e551d880976d2874d015

Download Submit
memory/996-143-0x0000000003D30000-0x0000000003D31000-memory.dmp

Filesize
4KB

Download
memory/996-144-0x0000000003D40000-0x0000000003D41000-memory.dmp

Filesize
4KB

Download
memory/996-137-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/996-138-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

Filesize
4KB

Download
memory/996-139-0x0000000003CF0000-0x0000000003CF1000-memory.dmp

Filesize
4KB

Download
memory/996-140-0x0000000003D00000-0x0000000003D01000-memory.dmp

Filesize
4KB

Download
memory/996-141-0x0000000003D10000-0x0000000003D11000-memory.dmp

Filesize
4KB

Download
memory/996-142-0x0000000003D20000-0x0000000003D21000-memory.dmp

Filesize
4KB

Download
memory/996-133-0x0000000003C90000-0x0000000003C91000-memory.dmp

Filesize
4KB

Download
memory/996-136-0x0000000003CC0000-0x0000000003CC1000-memory.dmp

Filesize
4KB

Download
memory/996-145-0x0000000003D50000-0x0000000003D51000-memory.dmp

Filesize
4KB

Download
memory/996-146-0x0000000003D60000-0x0000000003D61000-memory.dmp

Filesize
4KB

Download
memory/996-147-0x0000000003D70000-0x0000000003D71000-memory.dmp

Filesize
4KB

Download
memory/996-148-0x0000000003D80000-0x0000000003D81000-memory.dmp

Filesize
4KB

Download
memory/996-149-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Filesize
4KB

Download
memory/996-150-0x0000000003DB0000-0x0000000003DB1000-memory.dmp

Filesize
4KB

Download
memory/996-151-0x0000000000400000-0x0000000001E2E000-memory.dmp

Filesize
26.2MB

Download
memory/996-135-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

Filesize
4KB

Download
memory/996-134-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

Filesize
4KB

Download