Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 12:22
Behavioral task
behavioral1
Sample
c89aedb68ce107626e0312928214efd3.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
c89aedb68ce107626e0312928214efd3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
c89aedb68ce107626e0312928214efd3.exe
-
Size
10KB
-
MD5
c89aedb68ce107626e0312928214efd3
-
SHA1
5b48b13b828779dcc927838ca2bdcd3f1b8a8536
-
SHA256
cca4fad30546b1681c2853e19e9b8fa01d2bb71216dd0636e494bfab7ff5cf99
-
SHA512
378aa91b4490e63745d87bda3827c1579262ab99169b027eea30a9311cc69e8af81b123bce32d82add843f4ce4b1e91241a27c9783f59bf98f10047aac8687e5
-
SSDEEP
192:I1Cy+dKfhEZTbADsYB3OOvsEKJGlTSA35991qn28yCtRWI8n7W2EwWkj2EBHGfdT:IoZ8fzDj3OOkFElTS0LGnVAWU24TLS
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4784-0-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4784-1-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4784-2-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4784-3-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4784-4-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4784-5-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4784-6-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4784-8-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4784-10-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4784-13-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 656 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\c89aedb68ce107626e0312928214efd3.exe"C:\Users\Admin\AppData\Local\Temp\c89aedb68ce107626e0312928214efd3.exe"1⤵PID:4784
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1472
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3772