Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 04:57
Behavioral task
behavioral1
Sample
7007815903552d49c85046560de56590N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7007815903552d49c85046560de56590N.exe
Resource
win10v2004-20240709-en
General
-
Target
7007815903552d49c85046560de56590N.exe
-
Size
8.5MB
-
MD5
7007815903552d49c85046560de56590
-
SHA1
b2b7490cb69a8ceedeac279baac53a2eeaf66ada
-
SHA256
6db1c730ea2002addf43d502a2cb2abdf851d0694002ad8eecb759369778cf1f
-
SHA512
50a716238d82596e5c353e99c4746a3c568f26eb7f9f09f0111cabccb810f10ec2a78606a316eff7d4829a877b8607acccf15750dcb7ad44dd84c7943c99a7d3
-
SSDEEP
49152:R6XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXxttttttttttttttttttttttttttttB:C
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1348 svrwsc.exe -
resource yara_rule behavioral1/memory/348-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x00080000000120ff-4.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe 7007815903552d49c85046560de56590N.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7007815903552d49c85046560de56590N.exe"C:\Users\Admin\AppData\Local\Temp\7007815903552d49c85046560de56590N.exe"1⤵
- Drops file in System32 directory
PID:348
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1348
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.8MB
MD5d1a930d202621687b8c376bb24362ce2
SHA13fb7ad1c7a5d705515afdebe7308765d16a0a1e6
SHA256922b3692e4a22be7e03388c5f7e19c3f6ccf1f987ba8f1138fe745a95041d900
SHA5121433619e0254407e2c8892af83db93535d4398400512e1a0b8d203dad65f6b0c8ceb17ad02ce493a6f4fb06a2d3c4cab579d20b6b49ff0b764fa469bba9c7127