Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
23-10-2023 08:46
General
-
Target
3a63992bc8760d45bd1e0887421fc7d510f490025109d5c1a7247d09ed2f14ff.exe
-
Size
2.5MB
-
MD5
eaca518b1e134dcb313324dfe5be66fb
-
SHA1
b4c66ccf5b67adb33ea9e6fa2c16e97f5d31f1df
-
SHA256
3a63992bc8760d45bd1e0887421fc7d510f490025109d5c1a7247d09ed2f14ff
-
SHA512
697513968490a072ab468b44b0e7e84f7480703b6d31d16db3d75be90b004d116ae57e1367e1d8ce436d48f661c193551a23716da1513577395d218d03296797
-
SSDEEP
49152:RSnEknyUzsrkl5daDwXt8aHc68V/V7L1T:GDn3z0kUDwXtfH+5V1T
Malware Config
Signatures
-
r77
r77 is an open-source, userland rootkit.
-
r77 rootkit payload 2 IoCs
Detects the payload of the r77 rootkit.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a63992bc8760d45bd1e0887421fc7d510f490025109d5c1a7247d09ed2f14ff.exe"C:\Users\Admin\AppData\Local\Temp\3a63992bc8760d45bd1e0887421fc7d510f490025109d5c1a7247d09ed2f14ff.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a.exeC:\Users\Admin\AppData\Local\Temp\\a.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5d5e098531d6c0d3d59541f934b62dfba
SHA1182489876f54e3f51fbcb468a04e18f5589f872c
SHA25606b4d1399741e9af55f549e9940319e1ef6ddf42266662142c214d85fd1f72af
SHA512b3c4a064c7603c0f737c805aee4b402634d8e1412a73c9a3acf5a2e9ad9d7e61ef06faa1e6ff3351caba6c2c7869dab6999f978ef6342019cc5a7a4da4660f33
-
Filesize
1.3MB
MD5d5e098531d6c0d3d59541f934b62dfba
SHA1182489876f54e3f51fbcb468a04e18f5589f872c
SHA25606b4d1399741e9af55f549e9940319e1ef6ddf42266662142c214d85fd1f72af
SHA512b3c4a064c7603c0f737c805aee4b402634d8e1412a73c9a3acf5a2e9ad9d7e61ef06faa1e6ff3351caba6c2c7869dab6999f978ef6342019cc5a7a4da4660f33
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
200KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB