Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
23/10/2023, 08:46 UTC
General
-
Target
3a63992bc8760d45bd1e0887421fc7d510f490025109d5c1a7247d09ed2f14ff.exe
-
Size
2.5MB
-
MD5
eaca518b1e134dcb313324dfe5be66fb
-
SHA1
b4c66ccf5b67adb33ea9e6fa2c16e97f5d31f1df
-
SHA256
3a63992bc8760d45bd1e0887421fc7d510f490025109d5c1a7247d09ed2f14ff
-
SHA512
697513968490a072ab468b44b0e7e84f7480703b6d31d16db3d75be90b004d116ae57e1367e1d8ce436d48f661c193551a23716da1513577395d218d03296797
-
SSDEEP
49152:RSnEknyUzsrkl5daDwXt8aHc68V/V7L1T:GDn3z0kUDwXtfH+5V1T
Malware Config
Signatures
-
r77
r77 is an open-source, userland rootkit.
-
r77 rootkit payload 2 IoCs
Detects the payload of the r77 rootkit.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a63992bc8760d45bd1e0887421fc7d510f490025109d5c1a7247d09ed2f14ff.exe"C:\Users\Admin\AppData\Local\Temp\3a63992bc8760d45bd1e0887421fc7d510f490025109d5c1a7247d09ed2f14ff.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a.exeC:\Users\Admin\AppData\Local\Temp\\a.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
-
DNS74.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse -
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
DNS1.208.79.178.in-addr.arpaRemote address:8.8.8.8:53Request1.208.79.178.in-addr.arpaIN PTRResponse1.208.79.178.in-addr.arpaIN PTRhttps-178-79-208-1amsllnwnet
-
DNS55.36.223.20.in-addr.arpaRemote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS254.178.238.8.in-addr.arpaRemote address:8.8.8.8:53Request254.178.238.8.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS11.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
DNS10.179.89.13.in-addr.arpaRemote address:8.8.8.8:53Request10.179.89.13.in-addr.arpaIN PTRResponse
-
8.8.8.8:5374.32.126.40.in-addr.arpadns
DNS Request
74.32.126.40.in-addr.arpa
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:531.208.79.178.in-addr.arpadns
DNS Request
1.208.79.178.in-addr.arpa
-
8.8.8.8:5355.36.223.20.in-addr.arpadns
DNS Request
55.36.223.20.in-addr.arpa
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53254.178.238.8.in-addr.arpadns
DNS Request
254.178.238.8.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5311.227.111.52.in-addr.arpadns
DNS Request
11.227.111.52.in-addr.arpa
-
8.8.8.8:5310.179.89.13.in-addr.arpadns
DNS Request
10.179.89.13.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5d5e098531d6c0d3d59541f934b62dfba
SHA1182489876f54e3f51fbcb468a04e18f5589f872c
SHA25606b4d1399741e9af55f549e9940319e1ef6ddf42266662142c214d85fd1f72af
SHA512b3c4a064c7603c0f737c805aee4b402634d8e1412a73c9a3acf5a2e9ad9d7e61ef06faa1e6ff3351caba6c2c7869dab6999f978ef6342019cc5a7a4da4660f33
-
Filesize
1.3MB
MD5d5e098531d6c0d3d59541f934b62dfba
SHA1182489876f54e3f51fbcb468a04e18f5589f872c
SHA25606b4d1399741e9af55f549e9940319e1ef6ddf42266662142c214d85fd1f72af
SHA512b3c4a064c7603c0f737c805aee4b402634d8e1412a73c9a3acf5a2e9ad9d7e61ef06faa1e6ff3351caba6c2c7869dab6999f978ef6342019cc5a7a4da4660f33
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
200KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB