Analysis
-
max time kernel
122s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01/01/2024, 15:34
General
-
Target
bf01d97d76a6bb8f3cfbf4a697403f4b686d43fabb429a7bf9427aa70371df78.exe
-
Size
3.8MB
-
MD5
7c3a6e3b8468a9ce9aa21b8afc140473
-
SHA1
9f2bae4257e6509e7aa467a623786a0c0b10a8c8
-
SHA256
bf01d97d76a6bb8f3cfbf4a697403f4b686d43fabb429a7bf9427aa70371df78
-
SHA512
df1172cdecbdfafe76db72244fa1b20ac5cca40ac596ae6157d1784c2890d5198bfbeba243a05a13e550ef3429f05670c065f2fc281f90df7973fe4e042e00e6
-
SSDEEP
98304:D7YlmkAB4MGZEmWAqG26XQ3hOeMP+pgODgRJCMwWtca4EOKKv1GeE2nMJrOlaN60:6YB4M4tjeHw4CnBvMB1rtbfhORKkf4CE
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf01d97d76a6bb8f3cfbf4a697403f4b686d43fabb429a7bf9427aa70371df78.exe"C:\Users\Admin\AppData\Local\Temp\bf01d97d76a6bb8f3cfbf4a697403f4b686d43fabb429a7bf9427aa70371df78.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD500a0c71dbc43efc7e53eea7243c35538
SHA157144dff50f3320eee576810f8770f7dce7ec124
SHA256ce59eb41a1f5aee393065fecae450e878a4bb83b5662edebfd524a852f0ac515
SHA512dadfac7fe9ec775ae9773c5e3f5b90af3070709f23b1458e549e21f058688dca4e4d1c3714c9f248031a3aedaff3b50a4d1c592a793640878890b901ce019f34
-
Filesize
3.9MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
4.1MB
-
Filesize
1.7MB
-
Filesize
1.2MB
-
Filesize
4.1MB
-
Filesize
1.7MB
-
Filesize
9.9MB