Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 14:19

General

  • Target

    005d63a86e84a4f6ab67e31112ac3eb9.exe

  • Size

    688KB

  • MD5

    005d63a86e84a4f6ab67e31112ac3eb9

  • SHA1

    501be85c05f08c2c42e63cbdce9da818f9c3bf4c

  • SHA256

    7c0bada1ef977f7b158ffa9ba3f761ca3c0b2cd169730b7c7ba0344fa4e32ae9

  • SHA512

    5c353e1766940b822e7793beee31b43e960b348701c196ca6cab8a7a340a1f554c35a2c5b34c4e9fda996829b9ba86ec56d1b2fd64cb750643f6431c84f778ab

  • SSDEEP

    12288:5O4KvdzIrTSQOCK6aIGs6MsQTnDiqMoyJB/f7tG2ebqimxT+fuL:7KvdziST61GvQzDiqMoyfJG1qPTJ

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\005d63a86e84a4f6ab67e31112ac3eb9.exe
    "C:\Users\Admin\AppData\Local\Temp\005d63a86e84a4f6ab67e31112ac3eb9.exe"
    1⤵
    • Checks processor information in registry
    PID:4472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4472-2-0x0000000003420000-0x00000000034EC000-memory.dmp

    Filesize

    816KB

  • memory/4472-1-0x0000000003500000-0x0000000003600000-memory.dmp

    Filesize

    1024KB

  • memory/4472-3-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-4-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-5-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-7-0x0000000003420000-0x00000000034EC000-memory.dmp

    Filesize

    816KB

  • memory/4472-6-0x0000000003500000-0x0000000003600000-memory.dmp

    Filesize

    1024KB

  • memory/4472-8-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-9-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-10-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-11-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-12-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-13-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-14-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-15-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-16-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-17-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-18-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-19-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB

  • memory/4472-20-0x0000000000400000-0x00000000032A7000-memory.dmp

    Filesize

    46.7MB