Overview

overview

7

Static

static

3

1,402,000,581.exe

windows7-x64

7

1,402,000,581.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2023, 06:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    1,402,000,581.exe

  • Size

    364KB

  • MD5

    c7f1ded743557b3af99217c48825d94c

  • SHA1

    a113cf0c01ddf633d4e93884c82137b5c1d99e6e

  • SHA256

    df12f48e8a2c51b07a2a2449efea35db1196df3613d2b9451447faf586e2d6e3

  • SHA512

    09cd8df3ba6cd2b19fc34a3c72da9d412ce09a1dc73128c71875d9f9977b73d4b639864aa3b4616b0f82de94955e6df55810c44e8880349032934b692f0c22af

  • SSDEEP

    6144:LnPdudwDzUSnuJOBgJKUYFnsiEAwBrNZCWKvecfsAAuRkPrTJPhw8HrVwkMGK3xg:LnPdvUSwOKKUYBUAwBryWK5PkD9PvLV/

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1,402,000,581.exe
    "C:\Users\Admin\AppData\Local\Temp\1,402,000,581.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Users\Admin\AppData\Local\Temp\sxrkvk.exe
      "C:\Users\Admin\AppData\Local\Temp\sxrkvk.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Users\Admin\AppData\Local\Temp\sxrkvk.exe
        "C:\Users\Admin\AppData\Local\Temp\sxrkvk.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1360

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\spuotbycfs.lk
          Filesize

          231KB

          MD5

          35721bf3e728e212e5b3feb946fb2176

          SHA1

          58169a2abfc8a3c735f5b2f84c6df0d98314d991

          SHA256

          e40eb6fa1d9e85dbed3d993f98668c3d8376d723f5afb064ff20f6f35112ca15

          SHA512

          fe4140fabd1c0a32dfca625ca04b7dbf7f951d7d0a1a0749381df675a7059a1951022cfe16a517e61b79e5b98d3e6b2a95113641e8f920136e15a5e583ca295b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\sxrkvk.exe
          Filesize

          193KB

          MD5

          dd1dc511b289b05591fabe6f4c76f9b5

          SHA1

          8dadfb33cb7ce9d2bf50a5a9347d1cd0b6a8cad1

          SHA256

          68c8863e0429af8f95bc608d7c9b88e1069ebaa3cc463e212004d0047430c0ed

          SHA512

          d2520343471926702f53ae0d666d8fc9e99124fb3679a4500da876b907d3448809a84fb57c4cb3dd68f1408955d22fe6d86269e46c3da9be6560dfdfe77b0119

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\sxrkvk.exe
          Filesize

          193KB

          MD5

          dd1dc511b289b05591fabe6f4c76f9b5

          SHA1

          8dadfb33cb7ce9d2bf50a5a9347d1cd0b6a8cad1

          SHA256

          68c8863e0429af8f95bc608d7c9b88e1069ebaa3cc463e212004d0047430c0ed

          SHA512

          d2520343471926702f53ae0d666d8fc9e99124fb3679a4500da876b907d3448809a84fb57c4cb3dd68f1408955d22fe6d86269e46c3da9be6560dfdfe77b0119

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\sxrkvk.exe
          Filesize

          193KB

          MD5

          dd1dc511b289b05591fabe6f4c76f9b5

          SHA1

          8dadfb33cb7ce9d2bf50a5a9347d1cd0b6a8cad1

          SHA256

          68c8863e0429af8f95bc608d7c9b88e1069ebaa3cc463e212004d0047430c0ed

          SHA512

          d2520343471926702f53ae0d666d8fc9e99124fb3679a4500da876b907d3448809a84fb57c4cb3dd68f1408955d22fe6d86269e46c3da9be6560dfdfe77b0119

          Download Submit

        • \Users\Admin\AppData\Local\Temp\sxrkvk.exe
          Filesize

          193KB

          MD5

          dd1dc511b289b05591fabe6f4c76f9b5

          SHA1

          8dadfb33cb7ce9d2bf50a5a9347d1cd0b6a8cad1

          SHA256

          68c8863e0429af8f95bc608d7c9b88e1069ebaa3cc463e212004d0047430c0ed

          SHA512

          d2520343471926702f53ae0d666d8fc9e99124fb3679a4500da876b907d3448809a84fb57c4cb3dd68f1408955d22fe6d86269e46c3da9be6560dfdfe77b0119

          Download Submit

        • \Users\Admin\AppData\Local\Temp\sxrkvk.exe
          Filesize

          193KB

          MD5

          dd1dc511b289b05591fabe6f4c76f9b5

          SHA1

          8dadfb33cb7ce9d2bf50a5a9347d1cd0b6a8cad1

          SHA256

          68c8863e0429af8f95bc608d7c9b88e1069ebaa3cc463e212004d0047430c0ed

          SHA512

          d2520343471926702f53ae0d666d8fc9e99124fb3679a4500da876b907d3448809a84fb57c4cb3dd68f1408955d22fe6d86269e46c3da9be6560dfdfe77b0119

          Download Submit

        • memory/1360-10-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

          Download

        • memory/1360-12-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

          Download

        • memory/1360-14-0x0000000000AF0000-0x0000000000DF3000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/1360-15-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

          Download

        • memory/1988-6-0x0000000000130000-0x0000000000132000-memory.dmp

          Filesize

          8KB

          Download