Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14-07-2024 14:27
Behavioral task
behavioral1
Sample
05085cf27b16756252da882476a1a3b0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
05085cf27b16756252da882476a1a3b0N.exe
Resource
win10v2004-20240709-en
General
-
Target
05085cf27b16756252da882476a1a3b0N.exe
-
Size
5.8MB
-
MD5
05085cf27b16756252da882476a1a3b0
-
SHA1
1052b9a8cca33a3f99ee065bf3f0c9a97427a1b1
-
SHA256
f73671ceb1a1aab60faf38593282c281877f46c66f3a7ca861dfa75a2d9b9c8c
-
SHA512
52ab41fc2e93736e32b1298cf166a29e657fca7596644f79a1a6a8f8267d1763a17e0e50bc1c30cca937f3b40a21234a91de79c32b110ccaff60abba5764bf90
-
SSDEEP
49152:EnQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ/:4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3648 svrwsc.exe -
resource yara_rule behavioral2/memory/1172-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/files/0x000900000001e600-4.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe 05085cf27b16756252da882476a1a3b0N.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05085cf27b16756252da882476a1a3b0N.exe"C:\Users\Admin\AppData\Local\Temp\05085cf27b16756252da882476a1a3b0N.exe"1⤵
- Drops file in System32 directory
PID:1172
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3648
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
MD5cb5496988292cd42cc84aceac5c21da4
SHA18f0c1792d90b68d0176f99c07d05c281e5482e4b
SHA256805a3f5f9a83807339c30897b3736adbcb8f0658e342edeb0ea62c46f43ebb1f
SHA512130fa30c75883f70de62ffabce674380f48c7477f985e6a590a9466fc1fb72eaa3cade9abaadfccb917390f368340b4f3ead722b6324e454d419564075ea65ec