Analysis
-
max time kernel
1565s -
max time network
1566s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 19:27
General
-
Target
CHECKER NETFLIX.exe
-
Size
501KB
-
MD5
c6b22d27af3fd2ff253ff0a34b3b755a
-
SHA1
4ec3d2cacac492dff6cb3ca90b3b91f2532c033c
-
SHA256
31d14b04023ab2d76844386bc1395c8c530a4627fd8403381284bb7834daefcb
-
SHA512
60e738fadcdd217c0e8ab6a88265405d161357de2e83702683927c75e277ca5bf83e707cb5b531fd3ef11de5763ce615afaaf38c48b9b9ae7c46386d5076f6cb
-
SSDEEP
12288:ciQDw/p32v5rqIc4VQj/9PKGpRwG/C2Fonfnex:NWCp34QIcFR/C6onfo
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CHECKER NETFLIX.exe"C:\Users\Admin\AppData\Local\Temp\CHECKER NETFLIX.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
4KB
-
Filesize
528KB
-
Filesize
536KB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB