Overview

overview

10

Static

static

10

61e88df559...d9.exe

windows7-x64

1

61e88df559...d9.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2023, 16:22 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe

  • Size

    1.7MB

  • MD5

    943a8bc28e09f8f546cbda6c1c30f932

  • SHA1

    8f3931c8a4939eb8ece5224330769ee996313771

  • SHA256

    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9

  • SHA512

    de3d6ce6a3ecdb8f2623b28ac3d539fa787a0ee45096ad62bfbae5631aad2a77767b1af498a1bf6bc0cf881313b3bd18d174ec27503a93b59df64a5f7412adb1

  • SSDEEP

    24576:SwCcpAmiqHyDUU4+h0bz4NFjgsHya7UjkkE3dawyDSVXT5X:SEpACyDd4+h0n4T17U7QXT5X

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    "C:\Users\Admin\AppData\Local\Temp\61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2340

Network

  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
  • flag-us
    DNS
    flingtrainer.com
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    Remote address:
    8.8.8.8:53
    Request
    flingtrainer.com
    IN A
No results found
  • 8.8.8.8:53
    flingtrainer.com
    dns
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    310 B
     5

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

  • 8.8.8.8:53
    flingtrainer.com
    dns
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    310 B
     5

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

  • 8.8.8.8:53
    flingtrainer.com
    dns
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    310 B
     5

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

  • 8.8.8.8:53
    flingtrainer.com
    dns
    61e88df559e00408f6b0cd894afdd39950a72df8f42a73cc5493d7ed6524eed9.exe
    310 B
     5

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

    DNS Request

    flingtrainer.com

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2340-0-0x0000000000550000-0x0000000000584000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2340-1-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2340-2-0x000000001B0F0000-0x000000001B170000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2340-3-0x000000001B0F0000-0x000000001B170000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2340-4-0x0000000000590000-0x000000000059A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2340-5-0x0000000000590000-0x000000000059A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2340-6-0x000000001B0F0000-0x000000001B170000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2340-10-0x000000001B0F0000-0x000000001B170000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2340-11-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2340-13-0x0000000000590000-0x000000000059A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2340-14-0x0000000000590000-0x000000000059A000-memory.dmp

    Filesize

    40KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.