Analysis
-
max time kernel
146s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:00
Static task
static1
Behavioral task
behavioral1
Sample
01dde6eab064a347e1b0b8dc3074e7ac96203e1bbd1bec7cddf4b6fdfadee61c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
01dde6eab064a347e1b0b8dc3074e7ac96203e1bbd1bec7cddf4b6fdfadee61c.exe
Resource
win10v2004-20240426-en
General
-
Target
01dde6eab064a347e1b0b8dc3074e7ac96203e1bbd1bec7cddf4b6fdfadee61c.exe
-
Size
7.8MB
-
MD5
636ea646281c99d3d05cdefdca29cf5e
-
SHA1
77b6e50b8866f7b41d678995b8d448237edcddef
-
SHA256
01dde6eab064a347e1b0b8dc3074e7ac96203e1bbd1bec7cddf4b6fdfadee61c
-
SHA512
f63f21d87a7204967b6de980f3385cfc48c6a956d6d071005e593b40886d5292b8ec62c604c76200f93136db81f5ee3626f1663b7ee7afc1a8f0fa3e37c64350
-
SSDEEP
98304:rjAblu+D30UKhddFLduZHGfkk9I+VE60bLenSGr5Pt9QbznrNMxdwlyYpXkWR+C0:/ygOZT+mxbL
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 14 IoCs
Processes:
resource yara_rule behavioral2/memory/4552-1-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-2-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-3-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-4-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-5-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-6-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-7-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-8-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-9-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-10-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-11-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-12-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-13-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4552-14-0x00007FF705BE0000-0x00007FF706421000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs