Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24-05-2024 02:57
General
-
Target
Unpacked/Dyre_Unpacked.exe
-
Size
1.0MB
-
MD5
4d1d43789e038c6a03c07083ca0b0809
-
SHA1
8c4d87363a4a2352847923091b9ddfa6891f2807
-
SHA256
05edcc3e5679ee254c78058c4f446e195544d3ff3374bd141c1895e7ed6a410b
-
SHA512
32de7891671af7049b22f8384735fbd342413b2dcafc1c3d94cfa773079e10a006fe21af730558a2839c1b07deb1edd3462b07bed777a5f306863991b9709710
-
SSDEEP
6144:rj7W89i5WWwR7A7XJfZ4FFhDhMWwR7A7XJVgNgG7:rjntWqA7X5Z+NMWqA7XOgG
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Unpacked\Dyre_Unpacked.exe"C:\Users\Admin\AppData\Local\Temp\Unpacked\Dyre_Unpacked.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\googleupdaterr.exeC:\Users\Admin\AppData\Local\Temp\Unpacked\Dyre_Unpacked.exe2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\googleupdaterr.exeFilesize
1.0MB
MD54d1d43789e038c6a03c07083ca0b0809
SHA18c4d87363a4a2352847923091b9ddfa6891f2807
SHA25605edcc3e5679ee254c78058c4f446e195544d3ff3374bd141c1895e7ed6a410b
SHA51232de7891671af7049b22f8384735fbd342413b2dcafc1c3d94cfa773079e10a006fe21af730558a2839c1b07deb1edd3462b07bed777a5f306863991b9709710
-
memory/3416-5-0x0000000002840000-0x000000000286D000-memory.dmpFilesize
180KB
-
memory/3416-7-0x0000000002840000-0x000000000286D000-memory.dmpFilesize
180KB
-
memory/3416-9-0x0000000002840000-0x000000000286D000-memory.dmpFilesize
180KB
-
memory/3416-8-0x0000000002810000-0x0000000002839000-memory.dmpFilesize
164KB
-
memory/3416-10-0x0000000002840000-0x000000000286D000-memory.dmpFilesize
180KB