Analysis
-
max time kernel
255s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
20/03/2025, 19:14
General
-
Target
Sorillus.rar
-
Size
69.9MB
-
MD5
a4a28906274f2395009d7e36f8c3e032
-
SHA1
f09131c0175774adc141d0f02b923288efb95e10
-
SHA256
c265f04f075e27e91611d7e88119823702801684bf39e48ca5c0a2232f994ece
-
SHA512
efbabc19bec15249d26af7c0c90d242a715984440f96ac6a24b21d4773a1ac909039897054e576841eff313c6c580af00d435a25ce1b1becf562311ccac7df8c
-
SSDEEP
1572864:hyC3saUVoVhrBWwDskPfUuuRWh0BFnRdKfSmPa3EbDv3:Q8saU2VBbQjzRWh0TyLy3Ef
Malware Config
Signatures
-
AdWind
A Java-based RAT family operated as malware-as-a-service.
-
Adwind family
-
Class file contains resources related to AdWind 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 64 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Sorillus.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Start.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\jre1.8.0_361\bin\java.exejre1.8.0_361\bin\java.exe -jar -noverify Sorillas.jar2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.0MB
MD518c002c3fe84222bb72543bc5f5bf0f9
SHA145914d63b0d9b3342517a4f1b9b77c464c28a58f
SHA25673ab04ed97f75312985e51cb0d7d9b274bc9ecdcd288392469c9e589fcbd64a6
SHA512908204a956182ec2ab075b5869eef2c215e0578d4350eb764058c1bbed990e2b4389c2a64f3960f716387d5c97d4559135b7a4ff0e4d09903d61011c4c588199
-
Filesize
60B
MD570c54cd2b9eaaab7ee387b2fa0c0fb4a
SHA17b16e52597dd6c3bab3880a1ed3da030667802e7
SHA25614748fda6836b077a0301788791753013e3a85f0a41b721c1d874c3f75140066
SHA51220693336461355b51abdc62f674b03bf6d29c73101dcbc775692f60d185d84554d60b7f0467901f1923da0f66e508afea72165eae86f0fa477a372ffe492dc6c
-
Filesize
11KB
MD5919e653868a3d9f0c9865941573025df
SHA1eff2d4ff97e2b8d7ed0e456cb53b74199118a2e2
SHA2562afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
SHA5126aec9d7767eb82ebc893ebd97d499debff8da130817b6bb4bcb5eb5de1b074898f87db4f6c48b50052d4f8a027b3a707cad9d7ed5837a6dd9b53642b8a168932
-
Filesize
11KB
MD57676560d0e9bc1ee9502d2f920d2892f
SHA14a7a7a99900e41ff8a359ca85949acd828ddb068
SHA25600942431c2d3193061c7f4dc340e8446bfdbf792a7489f60349299dff689c2f9
SHA512f1e8db9ad44cd1aa991b9ed0e000c58978eb60b3b7d9908b6eb78e8146e9e12590b0014fc4a97bc490ffe378c0bf59a6e02109bfd8a01c3b6d0d653a5b612d15
-
Filesize
11KB
MD5ac51e3459e8fce2a646a6ad4a2e220b9
SHA160cf810b7ad8f460d0b8783ce5e5bbcd61c82f1a
SHA25677577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
SHA5126239240d4f4fa64fc771370fb25a16269f91a59a81a99a6a021b8f57ca93d6bb3b3fcecc8dede0ef7914652a2c85d84d774f13a4143536a3f986487a776a2eae
-
Filesize
11KB
MD5b0e0678ddc403effc7cdc69ae6d641fb
SHA1c1a4ce4ded47740d3518cd1ff9e9ce277d959335
SHA25645e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
SHA5122badf761a0614d09a60d0abb6289ebcbfa3bf69425640eb8494571afd569c8695ae20130aac0e1025e8739d76a9bff2efc9b4358b49efe162b2773be9c3e2ad4
-
Filesize
11KB
MD594788729c9e7b9c888f4e323a27ab548
SHA1b0ba0c4cf1d8b2b94532aa1880310f28e87756ec
SHA256accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
SHA512ab65495b1d0dd261f2669e04dc18a8da8f837b9ac622fc69fde271ff5e6aa958b1544edd8988f017d3dd83454756812c927a7702b1ed71247e506530a11f21c6
-
Filesize
14KB
MD5580d9ea2308fc2d2d2054a79ea63227c
SHA104b3f21cbba6d59a61cd839ae3192ea111856f65
SHA2567cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
SHA51297c1d3f4f9add03f21c6b3517e1d88d1bf9a8733d7bdca1aecba9e238d58ff35780c4d865461cc7cd29e9480b3b3b60864abb664dcdc6f691383d0b281c33369
-
Filesize
11KB
MD535bc1f1c6fbccec7eb8819178ef67664
SHA1bbcad0148ff008e984a75937aaddf1ef6fda5e0c
SHA2567a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
SHA5129ab9b5b12215e57af5b3c588ed5003d978071dc591ed18c78c4563381a132edb7b2c508a8b75b4f1ed8823118d23c88eda453cd4b42b9020463416f8f6832a3d
-
Filesize
11KB
MD53bf4406de02aa148f460e5d709f4f67d
SHA189b28107c39bb216da00507ffd8adb7838d883f6
SHA256349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
SHA5125ff6e8ad602d9e31ac88e06a6fbb54303c57d011c388f46d957aee8cd3b7d7cced8b6bfa821ff347ade62f7359acb1fba9ee181527f349c03d295bdb74efbace
-
Filesize
11KB
MD5bbafa10627af6dfae5ed6e4aeae57b2a
SHA13094832b393416f212db9107add80a6e93a37947
SHA256c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
SHA512d5fcba2314ffe7ff6e8b350d65a2cdd99ca95ea36b71b861733bc1ed6b6bb4d85d4b1c4c4de2769fbf90d4100b343c250347d9ed1425f4a6c3fe6a20aed01f17
-
Filesize
11KB
MD53a4b6b36470bad66621542f6d0d153ab
SHA15005454ba8e13bac64189c7a8416ecc1e3834dc6
SHA2562e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
SHA51284b00167abe67f6b58341045012723ef4839c1dfc0d8f7242370c4ad9fabbe4feefe73f9c6f7953eae30422e0e743dc62503a0e8f7449e11c5820f2dfca89294
-
Filesize
11KB
MD5a038716d7bbd490378b26642c0c18e94
SHA129cd67219b65339b637a1716a78221915ceb4370
SHA256b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
SHA51243cb12d715dda4dcdb131d99127417a71a16e4491bc2d5723f63a1c6dfabe578553bc9dc8cf8effae4a6be3e65422ec82079396e9a4d766bf91681bdbd7837b1
-
Filesize
12KB
MD5d75144fcb3897425a855a270331e38c9
SHA1132c9ade61d574aa318e835eb78c4cccddefdea2
SHA25608484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
SHA512295a6699529d6b173f686c9bbb412f38d646c66aab329eac4c36713fdd32a3728b9c929f9dcadde562f625fb80bc79026a52772141ad2080a0c9797305adff2e
-
Filesize
13KB
MD58acb83d102dabd9a5017a94239a2b0c6
SHA19b43a40a7b498e02f96107e1524fe2f4112d36ae
SHA256059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
SHA512b7ecf60e20098ea509b76b1cc308a954a6ede8d836bf709790ce7d4bd1b85b84cf5f3aedf55af225d2d21fbd3065d01aa201dae6c131b8e1e3aa80ed6fc910a4
-
Filesize
163KB
MD5db081a9968bb0c37a57725cdb66a0c7b
SHA1d5fed172d82111d1f3bcb46ab3bd8b412f3ee003
SHA2565b9b01f1ec06ad559285201cf0907e1c31473f6fb91aa09813dd8f076f94afe3
SHA5128a3717be2bdc1d2e628a069a61ac5b504467c52c7b52496c14050cd0fbc3e1023c791ca8b5c3270579e1cc725a8a0cff62c427dc1c25c2ec74725d1dacc621d5
-
Filesize
273KB
MD547b34557cbf069e0ad9807305cb5c36a
SHA158abfbefc486427175b15e69e8e8f4e346318c34
SHA256cabcfcf1aebf926bbe03b2aded9e7bbb57f4e10600578a6f2acafbf83b7423d4
SHA512f9354ec19c3bad2a3a9e95211a306e54ebe559127d8ae660ce75c88839afd558821a0a858366db8820517cb12f7fe0056bb5c09199c1fe1a9083e299b02a148d
-
Filesize
613KB
MD5c1b066f9e3e2f3a6785161a8c7e0346a
SHA18b3b943e79c40bc81fdac1e038a276d034bbe812
SHA25699e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
SHA51236f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728
-
Filesize
8.2MB
MD5a5b5e313919826735b73731252a2bc2e
SHA1090054f0aeeaaac570130ef5a03c26970cdb050c
SHA25686765f3558ffbb2cf28fb683ee17c288967e636b5cb4fe0422ade39591f6abf4
SHA5122e0199624f91f9c952ea4fb81a01096febe8dde6fba85f66e7978c98ba749da3cd53cb6d986260e357c19a1d3b5411d6716548ef57e31ec75d55f4d3a3420c3f
-
Filesize
83KB
MD51453290db80241683288f33e6dd5e80e
SHA129fb9af50458df43ef40bfc8f0f516d0c0a106fd
SHA2562b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
SHA5124ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
-
Filesize
54KB
MD5c15088054d639475e51b88251369c226
SHA18849a9ee53e6bc7d1618103b674a6f481b72f3aa
SHA256a7e7890ec2e238b3108fe2d9b4796898b2fff30ce07957f60689975d7460098c
SHA51281ae70caf0304c63adadc3437e592ea9540db59ac7bd7417b769b5702a2aa012bec79aab8ce01187ebbd78555b7824fc4434a113dd9be5b667ce693b293122c4
-
Filesize
84KB
MD57c7a8adce66eeb67a96ca617c8286d72
SHA1da1f100637f0b94aaea4e3999ef96a32a63bfc2b
SHA256d15be64cc05ae14db69b5a3558cd57767eda91e708c74d3dccdc4958c42cb5d9
SHA51200d3c1145b8c8ea246f456000c2fcfe1e978d148ad69ddabdf9e5f332db4e44025211916c6452b5030f8326d523d6e72de8aebd9e41d83afccb8713e88782f31
-
Filesize
634B
MD5499f2a4e0a25a41c1ff80df2d073e4fd
SHA1e2469cbe07e92d817637be4e889ebb74c3c46253
SHA25680847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
SHA5127828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d
-
Filesize
2.9MB
MD582ade56ed7fa67287198802746ee6045
SHA12c5ad0a04bd0fae259cf29af346379284c684d42
SHA256c89895405e63110d69bb37178f0650bf2a4a489ab9e98da613464c61c475b58c
SHA512cd3c2180e185d1fce354ede366845668ab165ad0ebf7fd9cd9fbb3723ab64c3515c30e772e1577a747468e530d677c7955b41528d39e6d3c8c988b11604e470d
-
Filesize
17.4MB
MD5671df034c39d335d5e9de4da7cf70e97
SHA1184aa46308c1af192f119b6cae48c6a567175592
SHA2560fb07fad0f05706dcdb487ef3fa8adfc97e1a47792ee9cb7af359c77a9393542
SHA5127512b351ef1429bb722318c415cbcd5459dc86678b11634e3dd8e83394e59a48551a817842d73107546ffdfe05eb06f7ab4ce6a853ce266f3503885d4517a8ed
-
Filesize
1KB
MD5005faac2118450bfcd46ae414da5f0e5
SHA19f5c887e0505e1bb06bd1fc7975a3219709d061d
SHA256f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8
SHA5128b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9
-
Filesize
153B
MD51e9d8f133a442da6b0c74d49bc84a341
SHA1259edc45b4569427e8319895a444f4295d54348f
SHA2561a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA51263d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
-
Filesize
119KB
MD51f4d4fc6b33c30c5782c66b80d92c4f9
SHA1194df32fb23b470dae4929605d18abd041c743c6
SHA25681b8de0e148ed3601cf5f1bdf2787c5b15213d842bc537af9ede9635d692b904
SHA512dfde7e03fc106b785887f2a409b3528c5862663f188c95f6a95c739bdfcc8c6205c03b739de1b259e9a8a0360aa4e10e8d4bce1a57445797a214160b8d98a085
-
Filesize
559KB
MD518c5aec1e008f781bf74707662920000
SHA1c29c11cda5b867b68cba1fa7cb331d54a66b3f56
SHA256e9eab8ec4712142a3ed9ac833d853e144043699c1712986736f3667a9267c11b
SHA5129988b510d7e036ef41673edd8e38e2f72b695741da3ef63678b808b5e10a76951d016e27cdd23857de0ed0f3b44be8f7fb3a141021b543f104f2a214e53ca74d
-
Filesize
1.7MB
MD5f095a5ac04775e1093d54822460cc5a7
SHA12e0f0ec528c41b437126c506a91fe1ad5e699865
SHA256784b8df88387ee27383d6db4e184b169a21cb4b8bcb0d8395a7b1ac2b128108a
SHA512c0b5ca94ead3dffd33e19a2d757b2b653867b4f539a143ef17baeef1015c3845aba4f0666ef1d0c7ce02d156ce826b9c324c8159983a71d19d60415d60e25d36
-
Filesize
2KB
MD591aa6ea7320140f30379f758d626e59d
SHA13be2febe28723b1033ccdaa110eaf59bbd6d1f96
SHA2564af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4
SHA51203428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb
-
Filesize
3.4MB
MD50fdcdf2b521c8ffba3fcae32a684358e
SHA145a3ae43334b1a0f46d76599d3926c40fa790965
SHA2562189d10490922562be379da742eedc5e77cac61a6d2a484a3ed4693965dfe290
SHA5121a1489faa7903bc24d4cc3fbd0ee80e79602a39ea9530f10075a52460e6100c807dbafb17e4b1a7997c23cbe3906808291be7718e6525a79a295e1ddc8ed9eda
-
Filesize
217KB
MD51bf71be111189e76987a4bb9b3115cb7
SHA140442c189568184b6e6c27a25d69f14d91b65039
SHA256cf5f5184c1441a1660aa52526328e9d5c2793e77b6d8d3a3ad654bdb07ab8424
SHA512cb18b69e98a194af5e3e3d982a75254f3a20bd94c68816a15f38870b9be616cef0c32033f253219cca9146b2b419dd6df28cc4ceeff80d01f400aa0ed101e061
-
Filesize
163KB
MD5881e150ab929e26d1f812c4342c15a7c
SHA118788c5d630fa695f9283f6393bfa541b2031508
SHA256c576c50642271bcdbfffed04f92dc8d6a981daf300914d0a20c8a5a5a57015c7
SHA512af18febdf3e0d5fc8111e6335bd8cc4fc8dd944910db8a4f3ebae284e3d1064eb793a25588007e3d1cee24051e11cf3328951a3f708375856d54176a53701b49
-
Filesize
164KB
MD58a36205bd9b83e03af0591a004bc97f4
SHA156c5c0d38bde4c1f1549dda43db37b09c608aad3
SHA2564e147ab64b9fdf6d89d01f6b8c3ca0b3cddc59d608a8e2218f9a2504b5c98e14
SHA512e96b43b0ca3fd7775d75a702f44cd1b0dfd325e1db317f7cba84efdf572571fe7594068f9132a937251aab8bd1f68783213677d4953aca197195fbe5db1f90d7
-
Filesize
43KB
MD5731484623dfcbf11c948feea896b83c8
SHA1464d1c30e20128907d6f6d667a48a3213ac4df83
SHA256a4d9acdd8e2bb188c832059a86636b4b26118d5965f0c08debd2b62c0d63c9a5
SHA5125dacfce6e70eff4141f107cd47c0c50068205485a9977fe60933238e750de8a46acaf99eed8dd08d70de2266360315db6b247e8e943fa276023c5360be81e794
-
Filesize
212KB
MD5629a55a7e793da068dc580d184cc0e31
SHA13564ed0b5363df5cf277c16e0c6bedc5a682217f
SHA256e64e508b2aa2880f907e470c4550980ec4c0694d103a43f36150ac3f93189bee
SHA5126c24c71bee7370939df8085fa70f1298cfa9be6d1b9567e2a12b9bb92872a45547cbabcf14a5d93a6d86cd77165eb262ba8530b988bf2c989fadb255c943df9b
-
Filesize
52KB
MD5de2d73ffb31b036a481049751970e2ca
SHA15c26b381aa54a3336729cbaf4281620e03c34873
SHA2565afafd11dad40cc06023a6a5c1a6793b1cb55720314a18d4352879d6214b014e
SHA512f19bda9d9f355dab1ae3846c5e3a6535e59c529d0efe6204dd54000f3e088cf94099a1ccab94c0fadf7631385b94ca8c667f76c0556066ea49f06b2ac1479adb
-
Filesize
124B
MD573170a0b32597f7f2394efda2fb0052c
SHA123b2b34660feedcfae760096debd44515c4fb580
SHA2568bab80ef1af4a46664abf487b23a3cb3ba2fd083fc06b820089cbd9644a20b78
SHA512ddc9e89df5a345c5d8d3b392aa9671c86afc2cb8ec0885430eab286ee1420ca11dc565e1afc482957564b2a5456d48a59d6a1a7e6ecff92f56abc8366fbc0719
-
Filesize
190B
MD56c80cc46e79e122ffd3548fe8cb29b2c
SHA184b5047e39ba1bdbfa6d371baef4ef303a8fc7c3
SHA2561489a290e7427c90c84ca7b77cd2d80df3dd9d8bcd522696ff94b60e5a03954b
SHA512cdb642b4368cd300c77bf7ab49474108a0f53abaca1247709ef0b9932b9e79e88c6a3db64bae9183d9af8433dd73e058582729be92358eaa5a9538cf0dbb4404
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.4MB
