Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2023, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe
Resource
win10v2004-20230915-en
General
-
Target
9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe
-
Size
7.3MB
-
MD5
111243e0a984dd3baa9ca8ed3d6e0d45
-
SHA1
681b49730b8bb9729b902be4c901593f32773dcc
-
SHA256
9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467
-
SHA512
f79123d33f1eb7dc495e23be195fdb5f5d5c38353eccbb0ad4e40727a745b8c600f9a3f388f78cbe4299ccb59f0eb48f4bd245f64bafd8585f028a0784bf055a
-
SSDEEP
196608:nabfHlwzkgqyGJiEHLPkrBzSqcS9uJVSKLaMqekhYA3:aiQ3rUEHL8N+qccUFaY
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe File created C:\Windows\system32\drivers\etc\hosts 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe 1036 9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe"C:\Users\Admin\AppData\Local\Temp\9f96c6ee910997fb68d7c59fa9991a0beebd592d6aacf9de5ae501a4669d2467.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1036
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121B
MD5410e0d065899b7a313a1b47fe1d4bb9f
SHA18c0804b2ae903d7d911f81d08d1400e32d843713
SHA256b13b979bb0b43e121e91c95174c7a6a08da54f87a243c096dec1461557a30bbf
SHA512e998f720db8e41eb2a550a853bad2457151d98c94b08d11990d1efc50a8d5ae44a8f693996412b3e178cc4614ab7b7137a83dc3fcb13a8239d150074eacba029