Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 04:08
Behavioral task
behavioral1
Sample
47abeea6a54e469dd6453287c388d1d0N.exe
Resource
win7-20240708-en
General
-
Target
47abeea6a54e469dd6453287c388d1d0N.exe
-
Size
8.8MB
-
MD5
47abeea6a54e469dd6453287c388d1d0
-
SHA1
346a7e05d8fc1cbd62182cfb4ef332665ce6297e
-
SHA256
3f628556b323a75db7be18f313198e4231baf1f5f3052734eccee06e7855b7b5
-
SHA512
547551cdc90cb161bd6f230d216ad16c034242a54b096db10994959dd848f31cdb26e33d3b16375cc6b4d1074ef68f5db54c887c6c8c26df8444a2b598c12c41
-
SSDEEP
98304:rGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGLtttttttttttttttttt7:0gggggggggggggggggggggq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2800 svrwsc.exe -
resource yara_rule behavioral1/memory/2092-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x000b00000001227f-4.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe 47abeea6a54e469dd6453287c388d1d0N.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47abeea6a54e469dd6453287c388d1d0N.exe"C:\Users\Admin\AppData\Local\Temp\47abeea6a54e469dd6453287c388d1d0N.exe"1⤵
- Drops file in System32 directory
PID:2092
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2800
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.0MB
MD55e1b363af06dd32ff212218ec5df70dc
SHA15a428c9e508b238a78d22ca74c475719152c578e
SHA2563913f1c684f1aaa5331f5959ddd932ba647e841d56065aeb9de15c459b4ba2ff
SHA512a6725e77392ad15da4d718126bc2206d8f68f2c9bd5091dcd2308c055a023d999a2b14ad67d6f4f86433194c916685904eae928e4d5a88a93d03508ed87bf758