Analysis
-
max time kernel
156s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 05:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c51ec8e328606ddafdb936bc5d65e524.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c51ec8e328606ddafdb936bc5d65e524.exe
-
Size
448KB
-
MD5
c51ec8e328606ddafdb936bc5d65e524
-
SHA1
f35e90c91aaafae03895d436a3865b2e6fb1c889
-
SHA256
630dd4719397b68ecee7da2350d592eff2705bf89464f651abbeb329166ad5cf
-
SHA512
a1e5b5386366954963baefb4f29e0ae9cce0eec42cc3fffef634b8781018d9b65e892ea6058e56fcb10b04a996c25e6d8836b899a20a479fa9bae69367ed4652
-
SSDEEP
12288:QboBb/W9ANGBAFb5i0P6HfewKQLYg0yCxi:4xBAiAHwfzj
Malware Config
Signatures
-
Dave packer 2 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/1828-3-0x00000000026A0000-0x00000000026D2000-memory.dmp dave behavioral2/memory/1828-6-0x00000000020B0000-0x00000000020E0000-memory.dmp dave -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c51ec8e328606ddafdb936bc5d65e524.exepid process 1828 c51ec8e328606ddafdb936bc5d65e524.exe 1828 c51ec8e328606ddafdb936bc5d65e524.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c51ec8e328606ddafdb936bc5d65e524.exe"C:\Users\Admin\AppData\Local\Temp\c51ec8e328606ddafdb936bc5d65e524.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1828-3-0x00000000026A0000-0x00000000026D2000-memory.dmpFilesize
200KB
-
memory/1828-6-0x00000000020B0000-0x00000000020E0000-memory.dmpFilesize
192KB
-
memory/1828-8-0x0000000002810000-0x000000000283F000-memory.dmpFilesize
188KB
-
memory/1828-9-0x00000000027E0000-0x000000000280E000-memory.dmpFilesize
184KB
-
memory/1828-10-0x0000000002810000-0x000000000283F000-memory.dmpFilesize
188KB
-
memory/1828-94-0x0000000002810000-0x000000000283F000-memory.dmpFilesize
188KB