Analysis
-
max time kernel
186s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 06:02
Behavioral task
behavioral1
Sample
2b078b766cf1daeefd687e26a6fc1b18.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b078b766cf1daeefd687e26a6fc1b18.exe
Resource
win10v2004-20231215-en
0 signatures
150 seconds
General
-
Target
2b078b766cf1daeefd687e26a6fc1b18.exe
-
Size
6.6MB
-
MD5
2b078b766cf1daeefd687e26a6fc1b18
-
SHA1
4140e587bbcf52fb88c6063bc0a1be810e40f131
-
SHA256
8fe1bdf894a348532ac867b19e75d8263bd655e5eba976d7ad7ec60597aedf6b
-
SHA512
07930864c121d056e878ad0da1801d46cc9cb8733364e1dda2432d5150f3a60ae913815a4012c5ab9e79898a5fa5e282bcdc45c6dd879390b7a98cb3c782fe42
-
SSDEEP
196608:N8Osp8bUVWUHHMi0EAdH0Jgz6oAJmM1e:uVtoUF0rdzKL1e
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2832-3-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-29-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-32-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-37-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-38-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-39-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-40-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-41-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-42-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-43-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-44-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-45-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-46-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-47-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-48-0x0000000000400000-0x0000000000EE5000-memory.dmp themida behavioral1/memory/2832-49-0x0000000000400000-0x0000000000EE5000-memory.dmp themida -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\driver.sys 2b078b766cf1daeefd687e26a6fc1b18.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\system\driver.temp 2b078b766cf1daeefd687e26a6fc1b18.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2832 2b078b766cf1daeefd687e26a6fc1b18.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2832 2b078b766cf1daeefd687e26a6fc1b18.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b078b766cf1daeefd687e26a6fc1b18.exe"C:\Users\Admin\AppData\Local\Temp\2b078b766cf1daeefd687e26a6fc1b18.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2832