b3847c94d840dd53c3ba7248734424f06715deacf6dd6ebb727c2f1a7de4c945

Resubmissions

14/01/2025, 06:18

250114-g2qvnsyrdy7

14/01/2025, 06:15

14/01/2025, 06:10

14/01/2025, 06:09

03/07/2022, 12:33

Analysis

max time kernel
73s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03/07/2022, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ultima_Multihack.exe
Size 6.4MB
Sample220703-pq62hsfcdn
SHA256 b3847c94d840dd53c3ba7248734424f06715deacf6dd6ebb727c2f1a7de4c945
MD5 a2f01be6e514a6cd3424f9762f2c5b02
SHA1 1553dd3e3556f2c82ab312659d5184952d0b9a4e
SHA512 fa9dd15980bd80bcd250a1ac990281824f822635b8d3bb7d1d1a78958c8ec084e775735c3c14c09337076c3f4fe1185cd06cfb4cd989fcc0be78bd99c577e616
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
444	ultima.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	Ultima_Multihack.exe

Loads dropped DLL 2 IoCs

pid	Process
444	ultima.exe
444	ultima.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 3556	828	Ultima_Multihack.exe	79
PID 828 wrote to memory of 3556	828	Ultima_Multihack.exe	79
PID 3556 wrote to memory of 444	3556	cmd.exe	82
PID 3556 wrote to memory of 444	3556	cmd.exe	82
PID 3556 wrote to memory of 444	3556	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\Ultima_Multihack.exe
"C:\Users\Admin\AppData\Local\Temp\Ultima_Multihack.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5EAF.tmp\5EB0.tmp\5EC1.bat C:\Users\Admin\AppData\Local\Temp\Ultima_Multihack.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Users\Admin\AppData\Local\Temp\5EAF.tmp\ultima.exe
    ultima.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5EC1.bat

Path C:\Users\Admin\AppData\Local\Temp\5EAF.tmp\5EB0.tmp\5EC1.bat
Size 48B
SHA256 b7a7e70f4a51a62b70a08919924409d102b3d797189cca93295a24caa7fa4508
MD5 a703e72757cc5721f6604f29501d1fcb
SHA1 f296318971c483966d39548c7b26072c58b1cb63
SHA512 f6c68271b63dedda9d7269d5a055b61ef68c5d9f6022e99cb1f08c1737085276c8ad63a7f79041b0076b960144cded460175b9ba09465e6641f00fff455b7764
MD5 SHA1 SHA512

Submit Download

Bunifu_UI_v1.5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\5EAF.tmp\Bunifu_UI_v1.5.3.dll
Size 236KB
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bunifu_UI_v1.5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\5EAF.tmp\Bunifu_UI_v1.5.3.dll
Size 236KB
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bunifu_UI_v1.5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\5EAF.tmp\Bunifu_UI_v1.5.3.dll
Size 236KB
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ultima.exe

Path C:\Users\Admin\AppData\Local\Temp\5EAF.tmp\ultima.exe
Size 5.8MB
SHA256 291c70fb8033924f6767371e3d5a53c896c57abc914b5729ef0a082cb63903fb
MD5 c67ec628289d5c29f6d3b925a8c0f4f9
SHA1 cf7710c70bdf807130f86241e1e6829594345fb7
SHA512 c6ef4e80f7a84f8c675576c18e753273eb5b345843c1c6d571137adbcd66214e2284e7e3d730fa8a5c0314edbac9ab70ab9b7c0eaa1668fe22e36fde9121a97f
SSDEEP 98304:JgGWepYHcpbhu4BQzVJMMQqYcKrQI14Jq7cfq5X00C6Ck2YKD5zynj5P5xlGJago:pWuY8LAJQqTqpxu5zynZAlxhk10zus6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ultima.exe

Path C:\Users\Admin\AppData\Local\Temp\5EAF.tmp\ultima.exe
Size 5.8MB
SHA256 291c70fb8033924f6767371e3d5a53c896c57abc914b5729ef0a082cb63903fb
MD5 c67ec628289d5c29f6d3b925a8c0f4f9
SHA1 cf7710c70bdf807130f86241e1e6829594345fb7
SHA512 c6ef4e80f7a84f8c675576c18e753273eb5b345843c1c6d571137adbcd66214e2284e7e3d730fa8a5c0314edbac9ab70ab9b7c0eaa1668fe22e36fde9121a97f
SSDEEP 98304:JgGWepYHcpbhu4BQzVJMMQqYcKrQI14Jq7cfq5X00C6Ck2YKD5zynj5P5xlGJago:pWuY8LAJQqTqpxu5zynZAlxhk10zus6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/444-136-0x0000000004FE0000-0x000000000507C000-memory.dmp

Download

memory/444-137-0x0000000005680000-0x0000000005C24000-memory.dmp

Download

memory/444-138-0x0000000005170000-0x0000000005202000-memory.dmp

Download

memory/444-139-0x00000000050E0000-0x00000000050EA000-memory.dmp

Download

memory/444-140-0x0000000005300000-0x0000000005356000-memory.dmp

Download

memory/444-144-0x0000000005360000-0x00000000053A2000-memory.dmp

Download

memory/444-135-0x00000000000B0000-0x0000000000684000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads