Overview
overview
7Static
static
5malware.exe
windows7-x64
3malware.exe
windows10-2004-x64
3malware.exe
windows7-x64
5malware.exe
windows10-2004-x64
5malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
7malware.exe
windows7-x64
5malware.exe
windows10-2004-x64
5malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
7malware.exe
windows7-x64
5malware.exe
windows10-2004-x64
5malware.exe
windows7-x64
3malware.exe
windows10-2004-x64
3malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
7malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
5Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 08:58
Behavioral task
behavioral1
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
malware.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
malware.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
malware.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
malware.exe
-
Size
133KB
-
MD5
7779f923da8c1418764fecc7d1ba86cf
-
SHA1
1dca672c62538457be0cfbccb6880c09d64d55b3
-
SHA256
664a551f2dfb0cebf3d17d80e60d6fccf82b6b7f0dfeb0b8b715810e93555c01
-
SHA512
747f50c3f42d23f397243d7f51652cef787ee385ebd561a6bd67afe5f7ca0229b278ecd6e957bc7fa666b061aaed9464cf1f027b92eaa28b7eef5ee7b02c02a8
-
SSDEEP
3072:oBCtQr2DkD0lRLb+4hLTyU06Y0a+rkaOQ7n4EXhMpe:oCQrZD0XRh0Z0aZah7n/hME
Malware Config
Signatures
-
resource yara_rule behavioral11/memory/1936-0-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral11/memory/1212-30-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-54-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-66-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-63-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-60-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-57-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-51-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-48-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-45-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-42-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-39-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-36-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-33-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-27-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-24-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-21-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1936-20-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral11/memory/1212-17-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-14-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-11-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-8-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1212-5-0x000000000EA00000-0x000000000EA39000-memory.dmp upx behavioral11/memory/1936-4163-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1936 malware.exe 1936 malware.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1936 malware.exe Token: SeDebugPrivilege 1936 malware.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 1212 1936 malware.exe 21 PID 1936 wrote to memory of 384 1936 malware.exe 3 PID 1936 wrote to memory of 384 1936 malware.exe 3 PID 1936 wrote to memory of 384 1936 malware.exe 3 PID 1936 wrote to memory of 384 1936 malware.exe 3 PID 1936 wrote to memory of 384 1936 malware.exe 3 PID 1936 wrote to memory of 384 1936 malware.exe 3
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1516
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1312
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:692
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:772
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1176
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:868
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:984
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:280
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:344
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1060
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1116
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:764
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1964
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2480
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\malware.exe"C:\Users\Admin\AppData\Local\Temp\malware.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
-