Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 02:52
Behavioral task
behavioral1
Sample
2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214.exe
Resource
win10v2004-20240508-en
General
-
Target
2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214.exe
-
Size
9.7MB
-
MD5
44250fcc122e675bad7ae5c12c36c290
-
SHA1
5d256c178212491566460c18c91b29159572ed49
-
SHA256
2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214
-
SHA512
da21d36c6aef45b2c37544a764c4f925503d59e9ed9a8f0e5bdf812f5897342fa02326070598076a631c89eb7868d11fadb219c7ed129531d9a38143bd842371
-
SSDEEP
196608:liCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCWWWWWWWWWWWWWWWWWWWWWWWWWWWWWs:le
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1184 svrwsc.exe -
resource yara_rule behavioral1/memory/2132-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/files/0x000c000000012286-4.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe 2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214.exe"C:\Users\Admin\AppData\Local\Temp\2fac07337599fd89258bdca05330eaac6055d68622053890a2235f13e1c64214.exe"1⤵
- Drops file in System32 directory
PID:2132
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1184
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.8MB
MD5b449f4c9350fdd280c7a68bf45ccb576
SHA1f818c99884e793ba14f6ca10dc43fd870412b1fc
SHA256a862260d7929766e3b9258d22afe14483b8bc81c020524a6d46594ade1261286
SHA5126e0497eb93e91e69802f07bf9f0456d945c117de1cdcb98b4d2c21bfbd191f56835bb8e50d8a1025698b28ac4da777e5a06f3ee286b43fbb2cbb831e5c10a7cc