Overview

overview

10

Static

static

10

Bootkits/5...1a.exe

windows7-x64

1

Bootkits/5...1a.exe

windows10-2004-x64

6

Bootkits/6...86.exe

windows7-x64

7

Bootkits/6...86.exe

windows10-2004-x64

7

Bootkits/8...f6.msi

windows7-x64

7

Bootkits/8...f6.msi

windows10-2004-x64

7

Bootkits/f...b1.exe

windows7-x64

7

Bootkits/f...b1.exe

windows10-2004-x64

Rootkits/0...c7.exe

windows7-x64

8

Rootkits/0...c7.exe

windows10-2004-x64

8

Rootkits/0...6d.exe

windows7-x64

10

Rootkits/0...6d.exe

windows10-2004-x64

1

Rootkits/0...ae.exe

windows7-x64

1

Rootkits/0...ae.exe

windows10-2004-x64

1

Rootkits/0...3e.exe

windows7-x64

7

Rootkits/0...3e.exe

windows10-2004-x64

10

Rootkits/0...10.exe

windows7-x64

7

Rootkits/0...10.exe

windows10-2004-x64

7

Rootkits/2...8e.dll

windows7-x64

1

Rootkits/2...8e.dll

windows10-2004-x64

1

Rootkits/2...a4.exe

windows7-x64

10

Rootkits/2...a4.exe

windows10-2004-x64

Rootkits/4...1b.exe

windows7-x64

7

Rootkits/4...1b.exe

windows10-2004-x64

7

Rootkits/6...d9.exe

windows7-x64

1

Rootkits/6...d9.exe

windows10-2004-x64

1

Rootkits/7...e8.exe

windows7-x64

7

Rootkits/7...e8.exe

windows10-2004-x64

7

Rootkits/8...22.exe

windows7-x64

1

Rootkits/8...22.exe

windows10-2004-x64

1

Rootkits/9...99.exe

windows7-x64

8

Rootkits/9...99.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    121s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    08-11-2023 03:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Rootkits/0925b8985b19d7925d68186d666b0050a4cb3f2a577d64765d770a57a2eab9ae.exe

  • Size

    104KB

  • MD5

    4f5c1bb12c487afacba8802b652210db

  • SHA1

    83883526d86b0dcd71327bad1b1b498fd548b7c9

  • SHA256

    0925b8985b19d7925d68186d666b0050a4cb3f2a577d64765d770a57a2eab9ae

  • SHA512

    c3cce308fc4464ab5473d4a170e087d15672c01dffbae5ea05323b47f4350ff6d0f1f1ea213b2c0bf1a4b5b92086187da8d3760963822a0b8af5b52de58249ad

  • SSDEEP

    1536:H2+Jxz5ugKNwH6E9RZhXl65YCo/SxeACesjw79dlz2Vgfsbg1gNE4wnX02yI/:/xzBKNk9RZ65Yr/BACesjwzstfNxuX/

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rootkits\0925b8985b19d7925d68186d666b0050a4cb3f2a577d64765d770a57a2eab9ae.exe
    "C:\Users\Admin\AppData\Local\Temp\Rootkits\0925b8985b19d7925d68186d666b0050a4cb3f2a577d64765d770a57a2eab9ae.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2364 -s 92
      2⤵
        PID:2788

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2364-0-0x00000000006D0000-0x0000000000BD0000-memory.dmp

      Filesize

      5.0MB

      Download