Overview
overview
10Static
static
7b6b59a54d6...0e.apk
android-9-x86
10b6b59a54d6...0e.apk
android-10-x64
10b6b59a54d6...0e.apk
android-11-x64
10callout_11_shadow.xml
windows7-x64
1callout_11_shadow.xml
windows10-2004-x64
3callout_7_overlay.xml
windows7-x64
1callout_7_overlay.xml
windows10-2004-x64
3callout_8_overlay.xml
windows7-x64
1callout_8_overlay.xml
windows10-2004-x64
1callout_cloud.xml
windows7-x64
1callout_cloud.xml
windows10-2004-x64
3callout_de...le.xml
windows7-x64
1callout_de...le.xml
windows10-2004-x64
3callout_shape_2.xml
windows7-x64
1callout_shape_2.xml
windows10-2004-x64
3callout_shape_4.xml
windows7-x64
1callout_shape_4.xml
windows10-2004-x64
3callout_shape_5.xml
windows7-x64
1callout_shape_5.xml
windows10-2004-x64
3callout_shape_6.xml
windows7-x64
1callout_shape_6.xml
windows10-2004-x64
3help.htm
windows7-x64
1help.htm
windows10-2004-x64
1help_cs.htm
windows7-x64
1help_cs.htm
windows10-2004-x64
1help_de.htm
windows7-x64
1help_de.htm
windows10-2004-x64
1help_es.htm
windows7-x64
1help_es.htm
windows10-2004-x64
1help_ru.htm
windows7-x64
1help_ru.htm
windows10-2004-x64
1help_uk.htm
windows7-x64
1Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07-08-2023 20:32
Static task
static1
Behavioral task
behavioral1
Sample
b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e.apk
Resource
android-x64-20230621-en
Behavioral task
behavioral3
Sample
b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e.apk
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral4
Sample
callout_11_shadow.xml
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
callout_11_shadow.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
callout_7_overlay.xml
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
callout_7_overlay.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
callout_8_overlay.xml
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
callout_8_overlay.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
callout_cloud.xml
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
callout_cloud.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
callout_dest_bubble.xml
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
callout_dest_bubble.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
callout_shape_2.xml
Resource
win7-20230712-en
Behavioral task
behavioral15
Sample
callout_shape_2.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
callout_shape_4.xml
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
callout_shape_4.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
callout_shape_5.xml
Resource
win7-20230712-en
Behavioral task
behavioral19
Sample
callout_shape_5.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
callout_shape_6.xml
Resource
win7-20230712-en
Behavioral task
behavioral21
Sample
callout_shape_6.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
help.htm
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
help.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
help_cs.htm
Resource
win7-20230712-en
Behavioral task
behavioral25
Sample
help_cs.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
help_de.htm
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
help_de.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
help_es.htm
Resource
win7-20230712-en
Behavioral task
behavioral29
Sample
help_es.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
help_ru.htm
Resource
win7-20230712-en
Behavioral task
behavioral31
Sample
help_ru.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
help_uk.htm
Resource
win7-20230712-en
General
-
Target
callout_cloud.xml
-
Size
4KB
-
MD5
cd47d4b3192545c91fdddeae5adb3d8a
-
SHA1
8d389882bb4a501bd8d2c9690a023d0c808213d7
-
SHA256
8ec8ca9e56edab13c9b45aa0dc21a4970398ba6917efb981e4533cd510c56d58
-
SHA512
58f8482402652807229c3d5a563c785f4f85d6f768592521b951ade7555826f49f45e41881b1012c0350ee5aa77e0e4daa22f207e0fa3ddf3f06c16e49817ddc
-
SSDEEP
96:7OKfETG9jU7aGyVS0/K4TL+uhBj0HPDYKnCZB4qdP9:SoZuaGyg01TPhUzMd1
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4132 3832 WerFault.exe 79
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\callout_cloud.xml"1⤵PID:3832
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3832 -s 4482⤵
- Program crash
PID:4132
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 3832 -ip 38321⤵PID:2992