Overview
overview
8Static
static
CF�...��.exe
windows7-x64
8CF�...��.exe
windows10-2004-x64
8CF�...��.url
windows7-x64
1CF�...��.url
windows10-2004-x64
1csla_30367.exe
windows7-x64
7csla_30367.exe
windows10-2004-x64
7˵.htm
windows7-x64
1˵.htm
windows10-2004-x64
1�...վ.url
windows7-x64
1�...վ.url
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 00:48
Static task
static1
Behavioral task
behavioral1
Sample
CFV1.0/CF½.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
CFV1.0/CF½.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
CFV1.0/.url
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
CFV1.0/.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
csla_30367.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
csla_30367.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
˵.htm
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
˵.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
վ.url
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
վ.url
Resource
win10v2004-20220812-en
General
-
Target
CFV1.0/CF½.exe
-
Size
7.0MB
-
MD5
adf3a9d53352bfbb476698ba6af45434
-
SHA1
25540b88c67d61f8766f9d1284c721754f011978
-
SHA256
3ff1b1faae2179aeb59d3ba080110e138f25e24f66bc52bf304ec269f012d550
-
SHA512
adcff3fde82b1c7dec4ed4a3eeff81c4b87d3e4045746149f18858e14beec9b44c68cc4f2df7392d631f3648e8c488bbc1e05b55a21fcc3f701d68802a7999d6
-
SSDEEP
98304:cepGTo0F7jR9pF6vhyFkf84hSyQt9Hwq2SJPaNRb7nPdDwQVD7y:B4ZjR9yyG04hbQUSQRXnlDwQVDG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
zesoeo5.dllpid process 2576 zesoeo5.dll -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\zesoeo5.dll vmprotect C:\Users\Admin\AppData\Local\Temp\zesoeo5.dll vmprotect behavioral2/memory/2576-135-0x0000000000400000-0x0000000000762000-memory.dmp vmprotect behavioral2/memory/2576-138-0x0000000000400000-0x0000000000762000-memory.dmp vmprotect behavioral2/memory/2576-139-0x0000000000400000-0x0000000000762000-memory.dmp vmprotect -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
CF½.exezesoeo5.dllpid process 2340 CF½.exe 2340 CF½.exe 2576 zesoeo5.dll 2576 zesoeo5.dll -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
CF½.exedescription pid process target process PID 2340 wrote to memory of 2576 2340 CF½.exe zesoeo5.dll PID 2340 wrote to memory of 2576 2340 CF½.exe zesoeo5.dll PID 2340 wrote to memory of 2576 2340 CF½.exe zesoeo5.dll
Processes
-
C:\Users\Admin\AppData\Local\Temp\CFV1.0\CF½.exe"C:\Users\Admin\AppData\Local\Temp\CFV1.0\CF½.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zesoeo5.dllC:\Users\Admin\AppData\Local\Temp\\zesoeo5.dll2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zesoeo5.dllFilesize
1.4MB
MD5c92f1112358c8797fbe987c53958b924
SHA184d9a09a9daddfb873ef63e3982cc591c65b61f4
SHA2562c91e80d1b5d245d608982bd28451cd6f77fb51edb8117ff9c2958766fc17a54
SHA5127111b3f0168d0975494d5d6efeec818c49280cd705a8bb2f95e25a68e5bad661ec574dc2dff9800f066d02926976cd0e68f3ff078f27cef628d2745bcb6bca21
-
C:\Users\Admin\AppData\Local\Temp\zesoeo5.dllFilesize
1.4MB
MD5c92f1112358c8797fbe987c53958b924
SHA184d9a09a9daddfb873ef63e3982cc591c65b61f4
SHA2562c91e80d1b5d245d608982bd28451cd6f77fb51edb8117ff9c2958766fc17a54
SHA5127111b3f0168d0975494d5d6efeec818c49280cd705a8bb2f95e25a68e5bad661ec574dc2dff9800f066d02926976cd0e68f3ff078f27cef628d2745bcb6bca21
-
memory/2576-132-0x0000000000000000-mapping.dmp
-
memory/2576-135-0x0000000000400000-0x0000000000762000-memory.dmpFilesize
3.4MB
-
memory/2576-138-0x0000000000400000-0x0000000000762000-memory.dmpFilesize
3.4MB
-
memory/2576-139-0x0000000000400000-0x0000000000762000-memory.dmpFilesize
3.4MB