Resubmissions
24-09-2022 21:20
220924-z6qdtaddbl 10Analysis
-
max time kernel
1521s -
max time network
1511s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
14-04-2024 12:44
General
-
Target
5e6764534b3a1e4d3abacc4810b6985d.exe
-
Size
740KB
-
MD5
5e6764534b3a1e4d3abacc4810b6985d
-
SHA1
f10ad287f126f577f197070453812a7e88c2cc52
-
SHA256
e7d3181ef643d77bb33fe328d1ea58f512b4f27c8e6ed71935a2e7548f2facc0
-
SHA512
532d2855e1b21433dbcc9c803f0538d99f6c3bddf0dd8321f552c7d16914dce4c2d2d3abd8028f45a4cf18109d430251d8fe8c63d30627e6fcc27d54cb42a188
-
SSDEEP
12288:az1bWgRkItsxHeYfpGcix2wytmyKsqVwoiFNoQEN5:+RkItsl7fofyKsqVwoiFNoQE3
Score
10/10
Malware Config
Signatures
-
Osiris
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e6764534b3a1e4d3abacc4810b6985d.exe"C:\Users\Admin\AppData\Local\Temp\5e6764534b3a1e4d3abacc4810b6985d.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\System32\wermgr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 10763⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3540 -ip 35401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
740KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
20KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
320KB
-
Filesize
616KB
-
Filesize
616KB