Analysis

  • max time kernel
    0s
  • max time network
    5s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-11-2024 07:35

General

  • Target

    RazDva cracked.exe

  • Size

    32.8MB

  • MD5

    fb56d088113ea58e5f40469287356245

  • SHA1

    27332eb7c906ce2782d551c9e61c97710aa962a6

  • SHA256

    df47c1f0868c73e0fad25c9b84eeebeb8ee105b4cfed7d38fabbabcb08cd3557

  • SHA512

    a22102d201f06789d2b796ad6e3745f7c090ef69f04bbc639fc242b3e86c2180a2fb13a14b07cff846905b9a894c9207986159bd508301f626d11661bed54bc0

  • SSDEEP

    393216:uQx7oo/fgwxFhVMcq9yG1CPwDv3uFhwwz/1rU2lvzCDOEmXbZduSsAR:u7O9z/xbZsSs

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RazDva cracked.exe
    "C:\Users\Admin\AppData\Local\Temp\RazDva cracked.exe"
    1⤵
      PID:3288
      • C:\Windows\System32\Wbem\wmic.exe
        wmic context
        2⤵
          PID:1636

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\evbAD39.tmp

        Filesize

        1KB

        MD5

        01516bb0c55531b03c685bd5a9ae9b50

        SHA1

        57b6a0979bf7ef2603ea83b649ad9534fea6735d

        SHA256

        5c5ec6441d083ea482aa4571ec6b77e0201114817ccc5c3fabd45865b2fd09ca

        SHA512

        3c21dab3a2a6a19010a60a6f4776accd07d62e3160cc5a11ab108d1c5f68937ca0a4893103b28cf6941dd509f716621c19a2158f251246cefbfc5f37f012de1b

      • C:\Users\Admin\AppData\Local\Temp\evbAE24.tmp

        Filesize

        1KB

        MD5

        b24e1a4e95ef8cd7522899420063b1f3

        SHA1

        ae1586aba28b089fa62edb4f607039e79137559e

        SHA256

        65a87347e5c4f633f542ac66a3e3c1a220666523aa4aa13d4dd0842595b47711

        SHA512

        b128b8161e9024dfe40ad22482957ece534dd97264a99965d6621b72d25b934bb49e7f78fa1b4c7077aa2d36efd2e05e3f6b57b1968857d857a087cf2c1e1ee6

      • C:\Users\Admin\AppData\Local\Temp\evbAE25.tmp

        Filesize

        1KB

        MD5

        8125213434a7fa4365ece498c0cbb0d0

        SHA1

        ecd681da190b037f40c45f41cc1a45a27ef88a9f

        SHA256

        da8e1584e52135fbe21409fbe151cc07ef809fd355165789005518141cabaef1

        SHA512

        8920512167338b24d0f0204548023408bbefc8ed3b14770b86f0950c7a8d824712e71574bd79500f3fd9aace152dd52e813f5fec483825adb4aece2320a8fc4d

      • C:\Users\Admin\AppData\Local\Temp\evbAE36.tmp

        Filesize

        1KB

        MD5

        306bcd01c56a9f1d113558976005e36e

        SHA1

        4ab14a010b7431714bd0ca6a3f4697e94244bcd8

        SHA256

        2f2d8739e9a2f2820467c3ddab6aef1ffb202e10b799a7beac80d96e1825c196

        SHA512

        41be5f0ded36827e65f04ab649e2888b12136f8961e409e9b1d5be2155136135575e45c53e34908d47ad0d23cebddedc4cb87a28da0fde0f0eefb1ed8f98b93a

      • C:\Users\Admin\AppData\Local\Temp\evbAE75.tmp

        Filesize

        1KB

        MD5

        4f07c2730e386198993706e584ae13bb

        SHA1

        baa5a3d2b4a7e64e64d16a747479f50f82794769

        SHA256

        160039ee2a3c99537aac9c7fa4bfca15992b4cd7320fd4c0923c4320e1c0854d

        SHA512

        5cd98ea6d5c287bf8881e987837f2d5582c946a95cf7b567bae162f3149c2111c941344c9d65372c8c538624cf2d18f3105747b7bb87d8b55fedcf9d8b27fe67

      • C:\Users\Admin\AppData\Local\Temp\evbAE86.tmp

        Filesize

        1KB

        MD5

        f1896ef7aee144783b7373b1fbfe84dc

        SHA1

        d44cb7ea88565c2b52da4cca341ec46a883f145b

        SHA256

        d77dfc7484173d988f89e6019813471677d720d03cf9ebc874d298a85a5db9a1

        SHA512

        5c769a17833fea3c15355a3425a50d8233eecb630f77bb08ede736bb354cd5ababefa3562f1a4123d10773526f5c9937d4f350d4c6be65ff314c20c4bfdc662d

      • C:\Users\Admin\AppData\Local\Temp\evbAE87.tmp

        Filesize

        1KB

        MD5

        cc65884232212f2c3f3614c5d9eda3d9

        SHA1

        2c6070d18879af7afd02f257937cdfb34f7d95ef

        SHA256

        8ec8f8de6f0790a0175e8bf7492a44789db0d04605939858ed2fb9a6100b6063

        SHA512

        95824fbc64b6e73be5465509751a69fceca108a785228726daef59a624d2c2b1b1a0d508732fc038ea87362d0de885b0e6c5c448fb6dc54107d79ef4d3c2291e

      • C:\Users\Admin\AppData\Local\Temp\evbAF62.tmp

        Filesize

        1KB

        MD5

        1e12bf3399c40eda4ae11a7f6add7cae

        SHA1

        85d59bfef68a352ced14ed9ddadfad94a109a916

        SHA256

        30f047d878b133e21d8f3d4f7afb697d2424a3fb925c62027d7c683c5a3918e6

        SHA512

        a6498914ed1fb7961a0f775b7f1d4b1c5beabbe2115bb1df7fdd8ce7b2868f8ccb0ed92688d704c46d3371bc6d19dc9b0442cbc1772a9bfd0dd856d229a4bb6d

      • C:\Users\Admin\AppData\Local\Temp\evbAFA2.tmp

        Filesize

        1KB

        MD5

        073de173d28dcc84d3078365eebe868f

        SHA1

        71d29f7ad67d5376445583d4990617335568c7cb

        SHA256

        6c3b3e438d52092093db739ab1b5eedb4e6f8daa768f07ef9c6c1aa2c030e2a9

        SHA512

        6119d1f1ad2870635570029711b5e68b4403e4bad039d68ae5f8a8174b7f9764d70399c14854f9566c3b6e83debd75ed746920dc7b4cfafbc7313f6f169e0b40

      • C:\Users\Admin\AppData\Local\Temp\evbAFF1.tmp

        Filesize

        1KB

        MD5

        493495b594ec4f632df45ecc82f3ee85

        SHA1

        0f7425707cfe33d2188c2c8a7631ec14c7c4b546

        SHA256

        f47e0c322b9332d81344b4fea298e34e9f94ccefaf234fedb3b7a0d8cde222ca

        SHA512

        38aa4340a5acdbc02fc6bde8aef7b1579a5659c74b44041cfb9e75af082078168517146743bd071ef22a6f222f56474b0e7960f94a018a903147f7c678791e62

      • C:\Users\Admin\AppData\Local\Temp\evbAFF2.tmp

        Filesize

        1KB

        MD5

        4b2f6dea46202a81b8026d1130a767c7

        SHA1

        9ad50a3fddda4a694ed287338c5670e0f28a2a55

        SHA256

        01dd7cade5ba3683a79d1eb10642982d7112f88b6fbbb3b771909fd9dc67a997

        SHA512

        34813cb21627b764b1a8cbe43378c77ab4358f610c81bfdf16f3049f46185464d1b202655694f1b259ffb90dd9d9581a700dc360d2db1352d79675be0231dbb8

      • C:\Users\Admin\AppData\Local\Temp\evbB0AF.tmp

        Filesize

        1KB

        MD5

        6afb259e5fbc9f83e5311e58a08459f3

        SHA1

        220d80d55f8b98fe820be842d006b4bc4c4582f4

        SHA256

        a562159c5701ed8f7dd55a4c90d25ecb35e63727360752359ac45075d9a57208

        SHA512

        f4f5c4c9f2cacb1bc46d93db8c3cdd489992f23cdf944241546dbbea8764695a6af13c42d2b20d3fe2fabab6be3f90e5f128c8532da600873ef7bb8602a25129

      • C:\Users\Admin\AppData\Local\Temp\evbB0DE.tmp

        Filesize

        1KB

        MD5

        c4cdf664be7ad4aca3d83fc5d121d2f8

        SHA1

        852cbce51eeb843d9875602d980bb33aaf55c54c

        SHA256

        0d3b01d19045712a6c41e272f1973ec4fea54118a289653ed51bcacfdecb4ce5

        SHA512

        62617d3306677d03dba7b9f47d944a5d30ef83231b3db173b58cd15689ad64de91407f2364849d2f2de7aa9fc38c26c43c4344f9496ea2e518c4ec49565a8430

      • memory/3288-90-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-75-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-66-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-74-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-86-0x0000000005480000-0x00000000054AA000-memory.dmp

        Filesize

        168KB

      • memory/3288-89-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-0-0x0000000140000000-0x00000001400A5000-memory.dmp

        Filesize

        660KB

      • memory/3288-92-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-91-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-97-0x00000000055C0000-0x00000000056D4000-memory.dmp

        Filesize

        1.1MB

      • memory/3288-102-0x00000000025F0000-0x0000000002617000-memory.dmp

        Filesize

        156KB

      • memory/3288-108-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-109-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-114-0x00000000055C0000-0x00000000056D4000-memory.dmp

        Filesize

        1.1MB

      • memory/3288-113-0x0000000005480000-0x00000000054AA000-memory.dmp

        Filesize

        168KB

      • memory/3288-112-0x0000000005450000-0x0000000005468000-memory.dmp

        Filesize

        96KB

      • memory/3288-111-0x0000000005280000-0x0000000005293000-memory.dmp

        Filesize

        76KB

      • memory/3288-110-0x0000000003FB0000-0x000000000405C000-memory.dmp

        Filesize

        688KB

      • memory/3288-107-0x0000000005730000-0x0000000005738000-memory.dmp

        Filesize

        32KB

      • memory/3288-106-0x00000000052F0000-0x00000000052F9000-memory.dmp

        Filesize

        36KB

      • memory/3288-105-0x00000000050E0000-0x00000000050EA000-memory.dmp

        Filesize

        40KB

      • memory/3288-104-0x0000000004060000-0x0000000004076000-memory.dmp

        Filesize

        88KB

      • memory/3288-103-0x0000000003C60000-0x0000000003FA8000-memory.dmp

        Filesize

        3.3MB

      • memory/3288-101-0x0000000180000000-0x000000018046C000-memory.dmp

        Filesize

        4.4MB

      • memory/3288-23-0x00000000006F0000-0x00000000006FF000-memory.dmp

        Filesize

        60KB

      • memory/3288-95-0x00000000055C0000-0x00000000056D4000-memory.dmp

        Filesize

        1.1MB

      • memory/3288-19-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-88-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-84-0x0000000005480000-0x00000000054AA000-memory.dmp

        Filesize

        168KB

      • memory/3288-18-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-80-0x0000000005450000-0x0000000005468000-memory.dmp

        Filesize

        96KB

      • memory/3288-78-0x0000000005450000-0x0000000005468000-memory.dmp

        Filesize

        96KB

      • memory/3288-16-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-64-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-11-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-70-0x0000000005280000-0x0000000005293000-memory.dmp

        Filesize

        76KB

      • memory/3288-68-0x0000000005280000-0x0000000005293000-memory.dmp

        Filesize

        76KB

      • memory/3288-12-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-58-0x0000000004060000-0x0000000004076000-memory.dmp

        Filesize

        88KB

      • memory/3288-56-0x0000000004060000-0x0000000004076000-memory.dmp

        Filesize

        88KB

      • memory/3288-9-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-51-0x0000000003FB0000-0x000000000405C000-memory.dmp

        Filesize

        688KB

      • memory/3288-45-0x0000000003FB0000-0x000000000405C000-memory.dmp

        Filesize

        688KB

      • memory/3288-39-0x0000000003C60000-0x0000000003FA8000-memory.dmp

        Filesize

        3.3MB

      • memory/3288-63-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-62-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-4-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-36-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-33-0x0000000003C60000-0x0000000003FA8000-memory.dmp

        Filesize

        3.3MB

      • memory/3288-26-0x00000000025F0000-0x0000000002617000-memory.dmp

        Filesize

        156KB

      • memory/3288-1-0x00007FF904FC3000-0x00007FF904FC4000-memory.dmp

        Filesize

        4KB

      • memory/3288-29-0x00000000025F0000-0x0000000002617000-memory.dmp

        Filesize

        156KB

      • memory/3288-20-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-17-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-15-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-14-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-13-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-5-0x0000000180000000-0x000000018046C000-memory.dmp

        Filesize

        4.4MB

      • memory/3288-115-0x0000000140000000-0x00000001400A5000-memory.dmp

        Filesize

        660KB

      • memory/3288-119-0x00000000025F0000-0x0000000002617000-memory.dmp

        Filesize

        156KB

      • memory/3288-131-0x00007FF904F20000-0x00007FF905129000-memory.dmp

        Filesize

        2.0MB

      • memory/3288-130-0x00007FF904FC3000-0x00007FF904FC4000-memory.dmp

        Filesize

        4KB

      • memory/3288-121-0x0000000003FB0000-0x000000000405C000-memory.dmp

        Filesize

        688KB

      • memory/3288-120-0x0000000003C60000-0x0000000003FA8000-memory.dmp

        Filesize

        3.3MB

      • memory/3288-117-0x0000000180000000-0x000000018046C000-memory.dmp

        Filesize

        4.4MB