Analysis

  • max time kernel
    23s
  • max time network
    18s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2025, 19:22

General

  • Target

    RC7.SERVERSIDED.exe

  • Size

    88KB

  • MD5

    d87744a0c9f854cf03664a0ebfe9f992

  • SHA1

    5faa5ffafce5d18ff16d34fbae7b1ba4c7405890

  • SHA256

    d01eb5e055638b7c7268936da934b03b603b853a55fbbe7b571fb94e384301ce

  • SHA512

    4360a2a7de7445dd1550e9c8fc59fc873ba26e3b8ed1d8a5bc7953059b33a251bca7bf0e59ec437b30b7c3a2e2261c23d25013b1f30b73067e7bb9c900ddf2cf

  • SSDEEP

    1536:k07ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIfew0:kKFfHgTWmCRkGbKGLeNTBfe1

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RC7.SERVERSIDED.exe
    "C:\Users\Admin\AppData\Local\Temp\RC7.SERVERSIDED.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:936
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8A3E.tmp\8A3F.tmp\8A40.bat C:\Users\Admin\AppData\Local\Temp\RC7.SERVERSIDED.exe"
      2⤵
        PID:3440

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\8A3E.tmp\8A3F.tmp\8A40.bat

            Filesize

            13B

            MD5

            c918928b3808b2aeebfcaa06592a5bcf

            SHA1

            d83f78a695ceed8f24c7f5bb0b1e77069dca7f99

            SHA256

            7f25f034c711c847a530736317a936d77f6145d6a8e9b9b71b9ff2bc69f7df52

            SHA512

            30d59baccd8e68cc1abfe786b1e4520b7b97a74d24a1a797e152290f2ffdaac5a51a30ad850b1cc2c9cd841f8f22373b12253994658826425910067aead91915

          • memory/936-0-0x0000000000417000-0x0000000000418000-memory.dmp

            Filesize

            4KB