Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
28-08-2023 01:08
General
-
Target
badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98.exe
-
Size
9.7MB
-
MD5
26dbb8cdc46ecf186fe07605207bf622
-
SHA1
916e3e9f55205fbd45ec1fbb47db370d4f668d18
-
SHA256
badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98
-
SHA512
f20a3f64747f61b4b8aebc04309ebd2b6490ec0c8d0d4a974a2ccbe730ec89681e1bfcf80c054efd6e49cc1931feac31859a3c0a3795c6ae7c8a90a0d1e7743f
-
SSDEEP
98304:zvw0Hotqx1pWuJ56DdIPqDyj/pCu03o8I6v+5/QGJbY9YAq+6FLiX:zY0Hotqx1EA56hLnr48IH/HK186
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Themida packer 19 IoCs
Detects Themida, an advanced Windows software protection system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98.exe"C:\Users\Admin\AppData\Local\Temp\badf6c49e41bef9c00e665b7273b2e8d712abb6e463e451c39d33494eb02bd98.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "EdgeUpdater-Task" /TR "C:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe" /SC MINUTE2⤵
- Creates scheduled task(s)
-
-
C:\ProgramData\MicrosoftEdgeTasker\edgeTaskUpdater.exeC:\ProgramData\\MicrosoftEdgeTasker\edgeTaskUpdater.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
422.8MB
MD513abb74a6c7e4f1f0046fb920e5d0130
SHA1df90ba6689a0831b39ff9b8ccafdfa3718f08495
SHA256589bb13274617b841d113de42d27badd141e0712d1cdf94706e134c432df98b5
SHA512e2f6dd2e13ffa558c1a53fe88f449c6e0fa29b43b96f71afc7d5cca33d1c3cb7afe83c9dddd21ae74c966434c6d71966a701232d39cb324205f623c9520a8887
-
Filesize
432.3MB
MD5a12b08369715e16eaa160b3d16ea46ea
SHA1dfd092c6e3d1a9ab938668a9e67d66000c8fec5d
SHA256e9a959ecdf2b8157784385d95919b8679bc7db302e705556c5cff196b778d30c
SHA512dfa12ab407abce94f431cc2030f23f8fae3aa69bd21c6a326b0abea359232dab691e062d549f6fc7e31be048f07d6c510c5357ff2cd0c809f8c22c585f9dfd58
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB