Overview
overview
7Static
static
5malware.exe
windows7-x64
3malware.exe
windows10-2004-x64
3malware.exe
windows7-x64
5malware.exe
windows10-2004-x64
5malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
7malware.exe
windows7-x64
5malware.exe
windows10-2004-x64
5malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
7malware.exe
windows7-x64
5malware.exe
windows10-2004-x64
5malware.exe
windows7-x64
3malware.exe
windows10-2004-x64
3malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
7malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
5Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 08:58
Behavioral task
behavioral1
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
malware.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
malware.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral14
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
malware.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
malware.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
malware.exe
-
Size
66KB
-
MD5
5942ba36cf732097479c51986eee91ed
-
SHA1
7cddef600cdae3890bbe2a2587e44de11bbc57bb
-
SHA256
9459b0d6f7cdec6860c458944386896f78cb60befdd04fbeab0df5b6661a3f81
-
SHA512
dcbcc98bc4d120cdbb0846abc9c2ab621b993f116aaccfec12812ebb3f42f9584e66f87d717327ec6955fa3d18f56444f16c8de39fbafdeb857cf285f24532c4
-
SSDEEP
1536:jDfWNrkKt4O2igKFicCR7fb/C7EchKmPKrjCKsOB0YxIma:jDfgj4OoICRvCwtZKOqCxa
Malware Config
Signatures
-
resource yara_rule behavioral7/memory/3004-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral7/memory/1172-4-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-7-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-10-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-13-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-16-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-19-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-22-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-25-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-28-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-40-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-37-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-34-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-31-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-61-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-64-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-58-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-55-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-52-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-49-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-46-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/1172-43-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx behavioral7/memory/3004-2015-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral7/memory/3004-2013-0x000000000EA00000-0x000000000EA1B000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3004 malware.exe 3004 malware.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3004 malware.exe Token: SeDebugPrivilege 3004 malware.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 1172 3004 malware.exe 21 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 380 3004 malware.exe 3 PID 3004 wrote to memory of 428 3004 malware.exe 5 PID 3004 wrote to memory of 428 3004 malware.exe 5 PID 3004 wrote to memory of 428 3004 malware.exe 5 PID 3004 wrote to memory of 428 3004 malware.exe 5 PID 3004 wrote to memory of 428 3004 malware.exe 5 PID 3004 wrote to memory of 428 3004 malware.exe 5 PID 3004 wrote to memory of 428 3004 malware.exe 5 PID 3004 wrote to memory of 428 3004 malware.exe 5
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:2024
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1612
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:668
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1128
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:852
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:960
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:276
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1028
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1052
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1116
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1440
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1928
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1648
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\malware.exe"C:\Users\Admin\AppData\Local\Temp\malware.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
-