Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
22/03/2025, 06:33
General
-
Target
0e820aad5e8af67e2f996c9261b1b8c500e26eab8fd99d9ec67dfecceb43aa54.exe
-
Size
291KB
-
MD5
bc87ea1bb1b4d40338ec591ff8c61257
-
SHA1
3fb705fb45d64565e691b71c2ab104933b36c481
-
SHA256
0e820aad5e8af67e2f996c9261b1b8c500e26eab8fd99d9ec67dfecceb43aa54
-
SHA512
84fe4ead9bf153512bfc8ede4b9ae3275035efc2eee955d7529e024c21c9bd19b343a5eddba22733e95200cb9557d8ffc8d24383dc3206642570a257fd13fc96
-
SSDEEP
6144:gqQDhqYPR4+n1X5nHRd7u/EKoY2axlZlkvbVZgh:gqQAYxn1XVHRd7eEKoSTggh
Score
10/10
Malware Config
Extracted
Family
vulturi
C2
http://78.70.235.238:5050:5050/gate
Attributes
-
c2_encryption_key
RW0cRe5Zs02XCURF84ns2Q
-
c2_user
root
Signatures
-
Vulturi
An info stealer written in C# and first seen in January 2021.
-
Vulturi family
-
Vulturi payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e820aad5e8af67e2f996c9261b1b8c500e26eab8fd99d9ec67dfecceb43aa54.exe"C:\Users\Admin\AppData\Local\Temp\0e820aad5e8af67e2f996c9261b1b8c500e26eab8fd99d9ec67dfecceb43aa54.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2000 -s 6362⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
9.9MB
-
Filesize
9.9MB