Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 16:25
Behavioral task
behavioral1
Sample
1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe
Resource
win7-20240903-en
General
-
Target
1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe
-
Size
8.6MB
-
MD5
c8f24570bd0c702a9619de2db3f1e930
-
SHA1
6a37d3d19d8769c2050b4396241214aab04aeab9
-
SHA256
1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292f
-
SHA512
3b45eaaabfa21c3eb3a9901bb6d73205704898fcc6993765b12c1b8e0299ab8bab6d146f1d145beb1072a4dab35ca926baa30fbaf0ad899084bd9294a6b13752
-
SSDEEP
196608:bIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIF:p
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2360 svrwsc.exe -
resource yara_rule behavioral1/memory/2104-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x000c00000001226d-4.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe 1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe"C:\Users\Admin\AppData\Local\Temp\1c76cd68db0156bc656ad736971a948be76ceba1477593ee11a0b18a3e15292fN.exe"1⤵
- Drops file in System32 directory
PID:2104
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2360
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.8MB
MD5027be465a545d1e74390bc029cdaf39d
SHA1fbdb02fd97a340f32e5a4e727f3cb8a2768f0e51
SHA256e6b084d3e48d60832ffc46f091c96c73b0a00598befa2ba1b9fbab3ff8d55e15
SHA5121a904b7b690024d1f617733847de2b54f298274a9dd21939bef2b6570c29d9f4212058ae82dfce15f1ed427b5133b2dd3845c6b0ff84d93f0c86b3ed19f5bf8a