Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
server - resources.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
server - resources.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
server - strings.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
server - strings.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
server.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
server.exe
Resource
win10v2004-20240709-en
General
-
Target
server.exe
-
Size
497KB
-
MD5
02c3aea8f99fe8e347e3f82c87fc6a81
-
SHA1
9e2ab065bf9c7948f8101e9b730d42be5c3262df
-
SHA256
a11e9facb1cf28832cb565ff31793640db1989bf710d0391fb81fe428809d144
-
SHA512
a44af0ae69e6c5c155b55e0fbcf1bf6a3c2b8afe5cd9e68635596a97890aee92594c1de937165922d30cfd544d60e02a8868acf8e6908b93877e3f9ff1efd365
-
SSDEEP
12288:+oqYCy3py+MLYTSrE8NrY+7G63XqDkwBWKsafOL2+3:+oqYbgrgarY+dXqDN4KsafOL2+3
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\y3k rat pro server = "C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe" server.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TMP32$2.cfg server.exe File created C:\Windows\SysWOW64\TMP32$1.Nil server.exe