Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
server - resources.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
server - resources.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
server - strings.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
server - strings.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
server.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
server.exe
Resource
win10v2004-20240709-en
General
-
Target
server - strings.exe
-
Size
497KB
-
MD5
a0fe5bfe79fcd7d20144164ff45440af
-
SHA1
7c0babb19b640b5a047879ce4463ca4871baa1aa
-
SHA256
91d5376675fbe9fc845b71ea9ffd0fe886c3ecdb1fd8157f8d4dfba64e36064b
-
SHA512
fcbf36433f07db2673f6f47c71653f20eb78a6269797adc021bc84f440e253f8bc010fdbaeca909fa19c751d4a826a90c1ad62cf76f31c68ccad0a953dd3684b
-
SSDEEP
12288:+oqYCS3py+MLYTSrE8NrY+7G63XqDkwBWKsafOL2eX:+oqY7grgarY+dXqDN4KsafOL2eX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\y3k rat pro server = "C:\\Users\\Admin\\AppData\\Local\\Temp\\server - strings.exe" server - strings.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TMP32$1.Nil server - strings.exe File created C:\Windows\SysWOW64\TMP32$2.cfg server - strings.exe