Overview

overview

4

Static

static

3

Fedoraloader.exe

windows10-1703-x64

4

Analysis

  • max time kernel
    35s
  • max time network
    38s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07-06-2024 18:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Fedoraloader.exe

  • Size

    383KB

  • MD5

    10c224b7f2471180d3ee88b9fe84a5ea

  • SHA1

    9eb4c6d14fc181c0688bdfb31deb2be665afc03d

  • SHA256

    8764f94b54312121d417fa7818ba011d3e9d87a54cbdbcb1f1cabe922bbb78e0

  • SHA512

    5ee6587ed30880db51be6c6e544af179158e03e1ca391bb64243540adf9d1ffed051f761b77eca605635c189ab355ae66fd780b0e6ff3ba14800764d47b99d92

  • SSDEEP

    6144:401B/bQ1LGrOQLPuHrl8XDCph0lhSMXlBXBWHVHLOZPni9Z7vBKe4vGtFYo5:jDQ1LokeWph0lhSMXlCVrlN/tFd

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fedoraloader.exe
    "C:\Users\Admin\AppData\Local\Temp\Fedoraloader.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:424
  • C:\Windows\System32\SystemSettingsBroker.exe
    C:\Windows\System32\SystemSettingsBroker.exe -Embedding
    1⤵
      PID:2408
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
      1⤵
        PID:4852
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservice -s SstpSvc
        1⤵
          PID:5088
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
          1⤵
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:3568
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s RasMan
          1⤵
            PID:1328

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\INF\netrasa.PNF
            Filesize

            22KB

            MD5

            80648b43d233468718d717d10187b68d

            SHA1

            a1736e8f0e408ce705722ce097d1adb24ebffc45

            SHA256

            8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

            SHA512

            eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

            Download Submit