Overview

overview

10

Static

static

3

2ef00e6680...8a.exe

windows7-x64

9

2ef00e6680...8a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    46s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 16:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2ef00e66804e808f9c5a4d6a1943cc8a.exe

  • Size

    4.2MB

  • MD5

    2ef00e66804e808f9c5a4d6a1943cc8a

  • SHA1

    6c7a46a69ac5d3f32d047a14c8ce03c1a53ec3a5

  • SHA256

    c21010f7c87e95f3df9c061e697437f5a165a194f69c88887ed36c6217b71d48

  • SHA512

    01380f1fafd75cd33e413282019305f525c410a2939525babc4ef0d2b529bd12db7349f066724d9ad473ce41c5c5ecf83d9e7cab560c37fb149ac3e3b77afb5c

  • SSDEEP

    98304:MosKQ+SGjJLHXW5ru4IufoXqXBEQzpPYKXsJuBfkL3O2s:Mos2SGj93wruGfoXqXBR8uBfL

Score
9/10

Malware Config

Signatures

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe
    "C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"
    1⤵
      PID:2072
      • C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe
        "C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"
        2⤵
          PID:2948
        • C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe
          "C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"
          2⤵
            PID:2228
          • C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe
            "C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"
            2⤵
              PID:2888
            • C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe
              "C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"
              2⤵
                PID:2732
              • C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe
                "C:\Users\Admin\AppData\Local\Temp\2ef00e66804e808f9c5a4d6a1943cc8a.exe"
                2⤵
                  PID:2788
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vrjKuutveP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC0B0.tmp"
                  2⤵
                  • Creates scheduled task(s)
                  PID:2804

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Persistence

              Scheduled Task/Job

              1
              T1053

              Privilege Escalation

              Scheduled Task/Job

              1
              T1053

              Defense Evasion

              Credential Access

              Discovery

              System Information Discovery

              1
              T1082

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Resource Development

              Reconnaissance

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/2072-1-0x0000000074380000-0x0000000074A6E000-memory.dmp
                Filesize

                6.9MB

                Download
              • memory/2072-0-0x0000000000110000-0x000000000054E000-memory.dmp
                Filesize

                4.2MB

                Download
              • memory/2072-2-0x00000000050A0000-0x00000000050E0000-memory.dmp
                Filesize

                256KB

                Download
              • memory/2072-3-0x0000000000690000-0x00000000006A2000-memory.dmp
                Filesize

                72KB

                Download
              • memory/2072-4-0x0000000074380000-0x0000000074A6E000-memory.dmp
                Filesize

                6.9MB

                Download
              • memory/2072-5-0x00000000050A0000-0x00000000050E0000-memory.dmp
                Filesize

                256KB

                Download
              • memory/2072-6-0x000000000AB30000-0x000000000AF46000-memory.dmp
                Filesize

                4.1MB

                Download
              • memory/2072-7-0x000000000AF40000-0x000000000B30E000-memory.dmp
                Filesize

                3.8MB

                Download
              • memory/2072-13-0x0000000074380000-0x0000000074A6E000-memory.dmp
                Filesize

                6.9MB

                Download