f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

max time kernel
155s
max time network
175s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24-07-2023 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Endermanch@DeriaLock.exe
Size

484KB
MD5

0a7b70efba0aa93d4bc0857b87ac2fcb
SHA1

01a6c963b2f5f36ff21a1043587dcf921ae5f5cd
SHA256

4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
SHA512

2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14
SSDEEP

6144:lqHKx3YCgy8HmmjJpnVhvLqCO3bLinIz1wASx:lqHoyHNj/nVhvLcyII

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

Endermanch@DeriaLock.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe Endermanch@DeriaLock.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe	Endermanch@DeriaLock.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Endermanch@DeriaLock.exe

pid	process
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe
2540	Endermanch@DeriaLock.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Endermanch@DeriaLock.exe

pid process

2540 Endermanch@DeriaLock.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Endermanch@DeriaLock.exe

description pid process

Token: SeDebugPrivilege 2540 Endermanch@DeriaLock.exe

description	pid	process
Token: SeDebugPrivilege	2540	Endermanch@DeriaLock.exe

C:\Users\Admin\AppData\Local\Temp\Endermanch@DeriaLock.exe
"C:\Users\Admin\AppData\Local\Temp\Endermanch@DeriaLock.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-55-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-54-0x00000000001D0000-0x0000000000252000-memory.dmp

Filesize
520KB

Download
memory/2540-56-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2540-57-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2540-188-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2540-189-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-190-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download