Overview

overview

10

Static

static

3

44dda79d57...21.exe

windows7-x64

10

44dda79d57...21.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    100s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-01-2024 00:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44dda79d57cab147763821a8b7538921.exe

  • Size

    288KB

  • MD5

    44dda79d57cab147763821a8b7538921

  • SHA1

    f0b7aa5c86c0d422e08879c847964deb6b4e283d

  • SHA256

    85119c7398f8c0e4eba8eeb5e6faeeb2d5951dfb87e4d7bb3f68157acc31bb7f

  • SHA512

    5f26ad91ccb1f9d00c50df37ed2bbaa28ca4ed1924b88be15987ccc0cf052f6b58518491c3bec7c4074c128e483be4a1a7059f2404bce423329a297ffbfaf0b2

  • SSDEEP

    6144:qd+kUXo2jyeq7EXtBqIE4+WnYAmpYesrsqbkhXyVvO7C1cwPh5HWAAr6LkQV6MHa:qTGo2jygX6B4+k33g5yw7CSoh52drOkj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44dda79d57cab147763821a8b7538921.exe
    "C:\Users\Admin\AppData\Local\Temp\44dda79d57cab147763821a8b7538921.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Local\5498033c\X
      *0*47*a3348a7e*31.193.3.240:53
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:976
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3412

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\5498033c\X
      Filesize

      38KB

      MD5

      72de2dadaf875e2fd7614e100419033c

      SHA1

      5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

      SHA256

      c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

      SHA512

      e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

      Download Submit
    • C:\Users\Admin\AppData\Local\5498033c\X
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      Download Submit
    • memory/2092-2-0x0000000000930000-0x0000000000A30000-memory.dmp
      Filesize

      1024KB

      Download
    • memory/2092-1-0x0000000030670000-0x00000000306C1000-memory.dmp
      Filesize

      324KB

      Download
    • memory/2092-9-0x0000000030670000-0x00000000306C1000-memory.dmp
      Filesize

      324KB

      Download
    • memory/3412-8-0x0000000007720000-0x0000000007728000-memory.dmp
      Filesize

      32KB

      Download