Overview

overview

10

Static

static

10

2023-07-14...op.exe

windows7-x64

3

2023-07-14...op.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2023, 12:52 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe

  • Size

    1.1MB

  • MD5

    f26dc426d49495e71e8aa0cf8c1061a0

  • SHA1

    a015d42c0c0f198dee57435cb71a3c3919158b07

  • SHA256

    26ae5e9d1e5b4cce78a18ac82166729d0925da9407090d545a4c1a1bad8343e2

  • SHA512

    1f0b8bd53ba1a153a76a3d7d62bf53d568b9dcd50619c9f58c10f677cec04fec824301f5a9544c8202f0fb85ecffd8465a8a439fc304cad1099319eda3fa58cd

  • SSDEEP

    24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/VRPOO8a/HUq7:F0dwAYZt6C31WeTNRPOhafUq7

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-07-14_f26dc426d49495e71e8aa0cf8c1061a0_stop.exe"
    1⤵
      PID:2036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 568
        2⤵
        • Program crash
        PID:3752
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2036 -ip 2036
      1⤵
        PID:836

      Network

      • flag-us
        DNS
        254.22.238.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        254.22.238.8.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        68.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        68.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        55.36.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        55.36.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        2.136.104.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.136.104.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        57.169.31.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        57.169.31.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        160.252.72.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        160.252.72.23.in-addr.arpa
        IN PTR
        Response
        160.252.72.23.in-addr.arpa
        IN PTR
        a23-72-252-160deploystaticakamaitechnologiescom
      • flag-us
        DNS
        43.229.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.229.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        89.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        89.16.208.104.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        tls
        73 B
         147 B
         1
        1
      • 8.8.8.8:53
        254.22.238.8.in-addr.arpa
        dns
        71 B
         125 B
         1
        1

        DNS Request

        254.22.238.8.in-addr.arpa

      • 8.8.8.8:53
        68.32.126.40.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        68.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        55.36.223.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        55.36.223.20.in-addr.arpa

      • 8.8.8.8:53
        2.136.104.51.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        2.136.104.51.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        57.169.31.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        57.169.31.20.in-addr.arpa

      • 8.8.8.8:53
        160.252.72.23.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        160.252.72.23.in-addr.arpa

      • 8.8.8.8:53
        43.229.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        43.229.111.52.in-addr.arpa

      • 8.8.8.8:53
        89.16.208.104.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        89.16.208.104.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.