Analysis
-
max time kernel
32s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 10:49
Behavioral task
behavioral1
Sample
ab8e463c37c1adec6bc4b07266ca7870N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ab8e463c37c1adec6bc4b07266ca7870N.exe
Resource
win10v2004-20240709-en
General
-
Target
ab8e463c37c1adec6bc4b07266ca7870N.exe
-
Size
9.5MB
-
MD5
ab8e463c37c1adec6bc4b07266ca7870
-
SHA1
d87251bcfb15c93313c723951d7f9edc9d9a71ed
-
SHA256
c31e4dbbaa9f05868b4e36e47aff3914204d9f122298b66f1c13565ab40c1648
-
SHA512
0ae23be09471c00220db8e2be8c772ff952d8582c39943dd9edcecbb893433cb1f5aa0c79ba34dc76db882e5f726eae7eacac441e371ddeec0def80130f54d24
-
SSDEEP
196608:T55555555555555555555555555555555555555dWWWWWWWWWWWWWWWWWWWWWWWF:T5555555555555555555555555555556
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2784 svrwsc.exe -
resource yara_rule behavioral1/memory/2688-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x00080000000120fd-4.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe ab8e463c37c1adec6bc4b07266ca7870N.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab8e463c37c1adec6bc4b07266ca7870N.exe"C:\Users\Admin\AppData\Local\Temp\ab8e463c37c1adec6bc4b07266ca7870N.exe"1⤵
- Drops file in System32 directory
PID:2688
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2784
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.8MB
MD53e589d0015bd74cdffa5ebffebe4f519
SHA12138fedfac573b56aae528eeec5074cf0d454629
SHA256e186c29bc43d05746a9683efb40c12db51b1aeec888109b22beeed18f5d59c04
SHA512b04c336788c8882394c333d081fe5ea159e339873366d723cb0452f5bbf520329ab21cd8eb9f8e3f155b96b121ae4fd2148f34d8622e4ab4f1bbc2a9f2ae2652