08a989233f339732da10dcc9ab1931f1ee5da84c7ae482ff7b2abdbc85d44b49

General

Target

murofet_0.0.0.7.vir.exe
Size

697KB
MD5

b1627dcab38582f63015732de52ac6c9
SHA1

9e0e4b9beceb63906df0e73697f38da220e67a6f
SHA256

08a989233f339732da10dcc9ab1931f1ee5da84c7ae482ff7b2abdbc85d44b49
SHA512

ec81c8b1773f037354b79b28bff186831dd2a932d6628c543ac63c8bf70f89752ae301609a9b6581f9fc89e7f4a515270378aec1fa5c3071155d37375591a4aa

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ejuj.exe

pid process

596 ejuj.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

ejuj.exe

pid	process
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe
596	ejuj.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WinMail.exe

pid process

1092 WinMail.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

WinMail.exe

pid process

1092 WinMail.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

murofet_0.0.0.7.vir.exe

description pid process target process

PID 112 set thread context of 1968 112 murofet_0.0.0.7.vir.exe cmd.exe

pid	process
1092	WinMail.exe

pid	process
1092	WinMail.exe

description	pid	process	target process
PID 112 set thread context of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ejuj.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run	ejuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{0DE71DBA-3458-F197-9CAA-72B48FFA5722} = "C:\\Users\\Admin\\AppData\\Roaming\\Gope\\ejuj.exe"	ejuj.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

murofet_0.0.0.7.vir.exeejuj.exe

description	pid	process	target process
PID 112 wrote to memory of 596	112	murofet_0.0.0.7.vir.exe	ejuj.exe
PID 112 wrote to memory of 596	112	murofet_0.0.0.7.vir.exe	ejuj.exe
PID 112 wrote to memory of 596	112	murofet_0.0.0.7.vir.exe	ejuj.exe
PID 112 wrote to memory of 596	112	murofet_0.0.0.7.vir.exe	ejuj.exe
PID 596 wrote to memory of 1180	596	ejuj.exe	taskhost.exe
PID 596 wrote to memory of 1180	596	ejuj.exe	taskhost.exe
PID 596 wrote to memory of 1180	596	ejuj.exe	taskhost.exe
PID 596 wrote to memory of 1180	596	ejuj.exe	taskhost.exe
PID 596 wrote to memory of 1180	596	ejuj.exe	taskhost.exe
PID 596 wrote to memory of 1256	596	ejuj.exe	Dwm.exe
PID 596 wrote to memory of 1256	596	ejuj.exe	Dwm.exe
PID 596 wrote to memory of 1256	596	ejuj.exe	Dwm.exe
PID 596 wrote to memory of 1256	596	ejuj.exe	Dwm.exe
PID 596 wrote to memory of 1256	596	ejuj.exe	Dwm.exe
PID 596 wrote to memory of 1300	596	ejuj.exe	Explorer.EXE
PID 596 wrote to memory of 1300	596	ejuj.exe	Explorer.EXE
PID 596 wrote to memory of 1300	596	ejuj.exe	Explorer.EXE
PID 596 wrote to memory of 1300	596	ejuj.exe	Explorer.EXE
PID 596 wrote to memory of 1300	596	ejuj.exe	Explorer.EXE
PID 596 wrote to memory of 112	596	ejuj.exe	murofet_0.0.0.7.vir.exe
PID 596 wrote to memory of 112	596	ejuj.exe	murofet_0.0.0.7.vir.exe
PID 596 wrote to memory of 112	596	ejuj.exe	murofet_0.0.0.7.vir.exe
PID 596 wrote to memory of 112	596	ejuj.exe	murofet_0.0.0.7.vir.exe
PID 596 wrote to memory of 112	596	ejuj.exe	murofet_0.0.0.7.vir.exe
PID 112 wrote to memory of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe
PID 112 wrote to memory of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe
PID 112 wrote to memory of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe
PID 112 wrote to memory of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe
PID 112 wrote to memory of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe
PID 112 wrote to memory of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe
PID 112 wrote to memory of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe
PID 112 wrote to memory of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe
PID 112 wrote to memory of 1968	112	murofet_0.0.0.7.vir.exe	cmd.exe
PID 596 wrote to memory of 820	596	ejuj.exe	DllHost.exe
PID 596 wrote to memory of 820	596	ejuj.exe	DllHost.exe
PID 596 wrote to memory of 820	596	ejuj.exe	DllHost.exe
PID 596 wrote to memory of 820	596	ejuj.exe	DllHost.exe
PID 596 wrote to memory of 820	596	ejuj.exe	DllHost.exe
PID 596 wrote to memory of 1424	596	ejuj.exe	DllHost.exe
PID 596 wrote to memory of 1424	596	ejuj.exe	DllHost.exe
PID 596 wrote to memory of 1424	596	ejuj.exe	DllHost.exe
PID 596 wrote to memory of 1424	596	ejuj.exe	DllHost.exe
PID 596 wrote to memory of 1424	596	ejuj.exe	DllHost.exe

Loads dropped DLL 2 IoCs

Processes:

murofet_0.0.0.7.vir.exe

pid process

112 murofet_0.0.0.7.vir.exe
112 murofet_0.0.0.7.vir.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

WinMail.exe

pid process

1092 WinMail.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1968 cmd.exe

pid	process
112	murofet_0.0.0.7.vir.exe
112	murofet_0.0.0.7.vir.exe

pid	process
1092	WinMail.exe

pid	process
1968	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

murofet_0.0.0.7.vir.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy	murofet_0.0.0.7.vir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	murofet_0.0.0.7.vir.exe

NTFS ADS 1 IoCs

Processes:

WinMail.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\6D11263C-00000001.eml:OECustomProperty	WinMail.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

murofet_0.0.0.7.vir.exeWinMail.exe

description	pid	process
Token: SeSecurityPrivilege	112	murofet_0.0.0.7.vir.exe
Token: SeSecurityPrivilege	112	murofet_0.0.0.7.vir.exe
Token: SeSecurityPrivilege	112	murofet_0.0.0.7.vir.exe
Token: SeManageVolumePrivilege	1092	WinMail.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1180

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1256

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\murofet_0.0.0.7.vir.exe
"C:\Users\Admin\AppData\Local\Temp\murofet_0.0.0.7.vir.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Users\Admin\AppData\Roaming\Gope\ejuj.exe
"C:\Users\Admin\AppData\Roaming\Gope\ejuj.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp9e2e63d7.bat"
3⤵
- Deletes itself
PID:1968

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:820

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9e2e63d7.bat

Download Submit
C:\Users\Admin\AppData\Roaming\Gope\ejuj.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Gope\ejuj.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Wiygxa\aqba.acl

Download Submit
\Users\Admin\AppData\Roaming\Gope\ejuj.exe

Download Submit
\Users\Admin\AppData\Roaming\Gope\ejuj.exe

Download Submit
memory/596-2-0x0000000000000000-mapping.dmp

Download
memory/1092-28-0x0000000003E00000-0x0000000003E02000-memory.dmp

Filesize
8KB

Download
memory/1092-33-0x00000000043E0000-0x00000000043E2000-memory.dmp

Filesize
8KB

Download
memory/1092-9-0x0000000003880000-0x0000000003980000-memory.dmp

Filesize
1024KB

Download
memory/1092-10-0x0000000003880000-0x0000000003A80000-memory.dmp

Filesize
2.0MB

Download
memory/1092-11-0x0000000003980000-0x0000000003A80000-memory.dmp

Filesize
1024KB

Download
memory/1092-15-0x0000000003AD0000-0x0000000003AD2000-memory.dmp

Filesize
8KB

Download
memory/1092-16-0x0000000003AF0000-0x0000000003AF2000-memory.dmp

Filesize
8KB

Download
memory/1092-17-0x0000000003AE0000-0x0000000003AE2000-memory.dmp

Filesize
8KB

Download
memory/1092-18-0x0000000003C40000-0x0000000003C42000-memory.dmp

Filesize
8KB

Download
memory/1092-19-0x0000000003D80000-0x0000000003D82000-memory.dmp

Filesize
8KB

Download
memory/1092-20-0x0000000003B40000-0x0000000003B42000-memory.dmp

Filesize
8KB

Download
memory/1092-21-0x0000000003AD0000-0x0000000003AD2000-memory.dmp

Filesize
8KB

Download
memory/1092-22-0x0000000003D80000-0x0000000003D82000-memory.dmp

Filesize
8KB

Download
memory/1092-23-0x0000000003AD0000-0x0000000003AD2000-memory.dmp

Filesize
8KB

Download
memory/1092-24-0x0000000003D80000-0x0000000003D82000-memory.dmp

Filesize
8KB

Download
memory/1092-25-0x0000000003CE0000-0x0000000003CE2000-memory.dmp

Filesize
8KB

Download
memory/1092-26-0x0000000003D80000-0x0000000003D82000-memory.dmp

Filesize
8KB

Download
memory/1092-27-0x0000000003D90000-0x0000000003D92000-memory.dmp

Filesize
8KB

Download
memory/1092-5-0x0000000003880000-0x0000000003980000-memory.dmp

Filesize
1024KB

Download
memory/1092-29-0x0000000003D70000-0x0000000003D72000-memory.dmp

Filesize
8KB

Download
memory/1092-30-0x0000000004260000-0x0000000004262000-memory.dmp

Filesize
8KB

Download
memory/1092-31-0x0000000004270000-0x0000000004272000-memory.dmp

Filesize
8KB

Download
memory/1092-32-0x0000000004280000-0x0000000004282000-memory.dmp

Filesize
8KB

Download
memory/1092-7-0x0000000003880000-0x0000000003A80000-memory.dmp

Filesize
2.0MB

Download
memory/1092-34-0x0000000004400000-0x0000000004402000-memory.dmp

Filesize
8KB

Download
memory/1092-35-0x0000000004410000-0x0000000004412000-memory.dmp

Filesize
8KB

Download
memory/1092-36-0x00000000044A0000-0x00000000044A2000-memory.dmp

Filesize
8KB

Download
memory/1092-37-0x00000000044B0000-0x00000000044B2000-memory.dmp

Filesize
8KB

Download
memory/1092-38-0x00000000044C0000-0x00000000044C2000-memory.dmp

Filesize
8KB

Download
memory/1092-39-0x0000000004530000-0x0000000004532000-memory.dmp

Filesize
8KB

Download
memory/1092-40-0x0000000004540000-0x0000000004542000-memory.dmp

Filesize
8KB

Download
memory/1092-41-0x0000000004550000-0x0000000004552000-memory.dmp

Filesize
8KB

Download
memory/1092-42-0x0000000004560000-0x0000000004562000-memory.dmp

Filesize
8KB

Download
memory/1092-43-0x0000000003B60000-0x0000000003B62000-memory.dmp

Filesize
8KB

Download
memory/1092-44-0x0000000003C30000-0x0000000003C32000-memory.dmp

Filesize
8KB

Download
memory/1092-45-0x00000000044E0000-0x00000000044E2000-memory.dmp

Filesize
8KB

Download
memory/1092-46-0x00000000044F0000-0x00000000044F2000-memory.dmp

Filesize
8KB

Download
memory/1092-47-0x0000000004500000-0x0000000004502000-memory.dmp

Filesize
8KB

Download
memory/1092-48-0x0000000004790000-0x0000000004792000-memory.dmp

Filesize
8KB

Download
memory/1092-49-0x00000000047A0000-0x00000000047A2000-memory.dmp

Filesize
8KB

Download
memory/1092-50-0x0000000003880000-0x0000000003980000-memory.dmp

Filesize
1024KB

Download
memory/1092-52-0x00000000023E0000-0x00000000023F0000-memory.dmp

Filesize
64KB

Download
memory/1092-58-0x0000000002010000-0x0000000002020000-memory.dmp

Filesize
64KB

Download
memory/1968-64-0x0000000000050000-0x000000000007E000-memory.dmp

Filesize
184KB

Download
memory/1968-66-0x00000000000716C4-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads