Resubmissions

09-05-2023 19:22

230509-x3fn4adg58 10

09-05-2023 19:14

230509-xxsrgaff7x 10

09-05-2023 19:14

230509-xxr5yadg42 7

09-05-2023 19:14

230509-xxrt6sff7w 8

09-05-2023 19:14

230509-xxrjeaff7v 8

09-05-2023 19:14

230509-xxqxwadg39 7

09-05-2023 19:14

230509-xxql4sff7t 10

09-05-2023 19:14

230509-xxqbcadg38 7

09-05-2023 19:10

230509-xvl6xadf64 10

Analysis

  • max time kernel
    130s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2023 19:10

General

  • Target

    trojan-leaks-main/Kirurg_remsaterd.exe

  • Size

    510KB

  • MD5

    6dd7ecf13f87fa885fede29cd4d31127

  • SHA1

    b9e133331ebccc6e97b90205de3801502637ce86

  • SHA256

    50042ed8c6c60b2dd79a23bb6589f83cd6ac3971fba798e6d2a580d3fea8ebf2

  • SHA512

    4cf4897f29b6e5048506ce30988052b7a600778a6648b9ab0eb2e5cc3f25521351cd70cbe5c5aac89a77c5b1af919f715cc163e400f38cadc25de9b8b77b23dc

  • SSDEEP

    3072:nJvLB6pF8gO5sBWHYAraok57QbHk/CD+2UAYvU1Dzn+XwDaucnuvim695e/3lG:ncvAr5eQbH0w+pv6zn+XwDarnuvB/3

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Kirurg_remsaterd.exe
    "C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Kirurg_remsaterd.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe
      "C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe"
      2⤵
      • Executes dropped EXE
      PID:2480
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x530 0x528
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1552

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe

    Filesize

    10KB

    MD5

    b5ff63f5352d3d79347f91737c5cd597

    SHA1

    3799699da69acf3e0c60921ca64272c84895ddd1

    SHA256

    0c6b8001912c8bd44fc110278f62486868a8d60647363bc6b4ab0b84f901f319

    SHA512

    115c44c042d237191ab1b612a8910f47db53b9b245f07307bf7efba3e459091c280e88ba9307e0d8a75329dac1529a2ddb858dd2426be3d66d94474c92aaefb4

  • C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe

    Filesize

    10KB

    MD5

    b5ff63f5352d3d79347f91737c5cd597

    SHA1

    3799699da69acf3e0c60921ca64272c84895ddd1

    SHA256

    0c6b8001912c8bd44fc110278f62486868a8d60647363bc6b4ab0b84f901f319

    SHA512

    115c44c042d237191ab1b612a8910f47db53b9b245f07307bf7efba3e459091c280e88ba9307e0d8a75329dac1529a2ddb858dd2426be3d66d94474c92aaefb4

  • C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe

    Filesize

    10KB

    MD5

    b5ff63f5352d3d79347f91737c5cd597

    SHA1

    3799699da69acf3e0c60921ca64272c84895ddd1

    SHA256

    0c6b8001912c8bd44fc110278f62486868a8d60647363bc6b4ab0b84f901f319

    SHA512

    115c44c042d237191ab1b612a8910f47db53b9b245f07307bf7efba3e459091c280e88ba9307e0d8a75329dac1529a2ddb858dd2426be3d66d94474c92aaefb4

  • memory/2104-133-0x00000000000B0000-0x0000000000136000-memory.dmp

    Filesize

    536KB

  • memory/2104-134-0x000000001AE50000-0x000000001AE60000-memory.dmp

    Filesize

    64KB

  • memory/2104-135-0x000000001AE50000-0x000000001AE60000-memory.dmp

    Filesize

    64KB

  • memory/2104-136-0x000000001AE50000-0x000000001AE60000-memory.dmp

    Filesize

    64KB

  • memory/2104-137-0x000000001AE50000-0x000000001AE60000-memory.dmp

    Filesize

    64KB