Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
14-08-2023 06:03
General
-
Target
e124d67c2826c790091a246499d7ee96afcc64654301fce55578e007bcc06493.exe
-
Size
3.4MB
-
MD5
9aa9efd79dd46aca3b19e9e74693edc4
-
SHA1
0d822bbf96f4a06608b199463610a3834952982b
-
SHA256
e124d67c2826c790091a246499d7ee96afcc64654301fce55578e007bcc06493
-
SHA512
f90482f5f3a72db0973505d70cb67d30dabf36c0aa94bb46e9f915c87cc90f5fa592e5d370628427030ed6855bbd2912c4576b5341e714db70c43fea70e3ab1c
-
SSDEEP
49152:vOxQnlJI9I/3h7g0WmF7mCjux45thzJV7mcxqhAyGWv4uA+A6e7u:WElJI9JVamfm5tFJVycQG0N0
Malware Config
Signatures
-
r77
r77 is an open-source, userland rootkit.
-
r77 rootkit payload 2 IoCs
Detects the payload of the r77 rootkit.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e124d67c2826c790091a246499d7ee96afcc64654301fce55578e007bcc06493.exe"C:\Users\Admin\AppData\Local\Temp\e124d67c2826c790091a246499d7ee96afcc64654301fce55578e007bcc06493.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a.exeC:\Users\Admin\AppData\Local\Temp\\a.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD53f1fdb5a55b85312fcc54b6f276bfc61
SHA1d797a6d2746d30c6a8025fb23a00b6f761050f43
SHA2567379cf675477c2048f21a1b32dbaeb225cd7d932bdf2f03aaa18a2a0c9e3aac2
SHA512a6f064d7f75c8712137d5d3c17a1fd4f705777a410c89a2f7cc2e5ddea21dbb830236166ce25e92a3cd2fba3e9a20df55bd0f0ce9b66bdec54c074e9c3cc11e7
-
Filesize
1.5MB
MD53f1fdb5a55b85312fcc54b6f276bfc61
SHA1d797a6d2746d30c6a8025fb23a00b6f761050f43
SHA2567379cf675477c2048f21a1b32dbaeb225cd7d932bdf2f03aaa18a2a0c9e3aac2
SHA512a6f064d7f75c8712137d5d3c17a1fd4f705777a410c89a2f7cc2e5ddea21dbb830236166ce25e92a3cd2fba3e9a20df55bd0f0ce9b66bdec54c074e9c3cc11e7
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB