Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 10:11
Behavioral task
behavioral1
Sample
30a78770615c6b42c17900c4ad03a9b708dc2d9b743bbdc51218597518749382.exe
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
30a78770615c6b42c17900c4ad03a9b708dc2d9b743bbdc51218597518749382.exe
-
Size
6.0MB
-
MD5
c024e5163ab6dd844813bf0d9a6f082b
-
SHA1
724081c323828f9c0547e3f21c0969632a59b42c
-
SHA256
30a78770615c6b42c17900c4ad03a9b708dc2d9b743bbdc51218597518749382
-
SHA512
f9410c691ca4f1ef8ca07b809e6f489dda975d3e8b721da8cce2c1aa12f469d024abf7630f5242d4ee023753390ee3441f9ccc505250803460c5965c8525455d
-
SSDEEP
98304:oEupHBqdbiPFUZ4DPsdhFjGKzNn/lSSYpoVzda2XmTiDa6Cpi43Jo3KSjt3fVO4L:Vuty2lczVgK57LsiAG35jt91hnG
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
mimikatz is an open source tool to dump credentials on Windows 3 IoCs
Processes:
resource yara_rule behavioral1/memory/848-1-0x000000013FB00000-0x0000000140605000-memory.dmp mimikatz behavioral1/memory/848-6-0x000000013FB00000-0x0000000140605000-memory.dmp mimikatz behavioral1/memory/848-11-0x000000013FB00000-0x0000000140605000-memory.dmp mimikatz -
Processes:
resource yara_rule behavioral1/memory/848-1-0x000000013FB00000-0x0000000140605000-memory.dmp vmprotect behavioral1/memory/848-6-0x000000013FB00000-0x0000000140605000-memory.dmp vmprotect behavioral1/memory/848-11-0x000000013FB00000-0x0000000140605000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
30a78770615c6b42c17900c4ad03a9b708dc2d9b743bbdc51218597518749382.exepid process 848 30a78770615c6b42c17900c4ad03a9b708dc2d9b743bbdc51218597518749382.exe