Analysis
-
max time kernel
291s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
22-07-2023 22:12
Static task
static1
Behavioral task
behavioral1
Sample
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe
Resource
win10-20230703-en
General
-
Target
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe
-
Size
4.1MB
-
MD5
bfaf9b1bbefa0dcf2333437f69b1ab98
-
SHA1
d1f5eb29d46d6480d28460dccc5158eb5a006336
-
SHA256
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c
-
SHA512
f4ef55c35136152837cd366c1dcecbb1046d5ca0ff74c88367c9cdb594a8fe106d68dec30793c5979d3da5940e1858f25dca962af65a0e8a9d426eaa2099845f
-
SSDEEP
6144:sB5f3YwKrMducTng1RxdBNE8ZOoXzeprQoXwg4kVUm+vL1kXwT/vEVqlKh:If3zKrMduNndr3zDepGkVwvhHXEVA0
Malware Config
Extracted
systembc
91.103.252.89:4317
91.103.252.57:4317
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\Run 40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe'\"" 40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2604-54-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2604-55-0x0000000000400000-0x000000000081F000-memory.dmpFilesize
4.1MB
-
memory/2604-56-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2604-58-0x0000000000400000-0x000000000081F000-memory.dmpFilesize
4.1MB
-
memory/2604-57-0x00000000034D0000-0x0000000003888000-memory.dmpFilesize
3.7MB