Overview
overview
10Static
static
7trojan-lea...V).exe
windows7-x64
10trojan-lea...V).exe
windows10-2004-x64
10trojan-lea...23.exe
windows7-x64
1trojan-lea...23.exe
windows10-2004-x64
1trojan-lea...ue.exe
windows7-x64
1trojan-lea...ue.exe
windows10-2004-x64
1trojan-lea...v2.exe
windows7-x64
1trojan-lea...v2.exe
windows10-2004-x64
1trojan-lea...rg.exe
windows7-x64
1trojan-lea...rg.exe
windows10-2004-x64
1trojan-lea...rd.exe
windows7-x64
7trojan-lea...rd.exe
windows10-2004-x64
7trojan-lea...ck.exe
windows7-x64
1trojan-lea...ck.exe
windows10-2004-x64
1trojan-lea...as.exe
windows7-x64
6trojan-lea...as.exe
windows10-2004-x64
6trojan-lea...ic.exe
windows7-x64
6trojan-lea...ic.exe
windows10-2004-x64
6trojan-lea...um.exe
windows7-x64
1trojan-lea...um.exe
windows10-2004-x64
1trojan-lea...um.exe
windows7-x64
8trojan-lea...um.exe
windows10-2004-x64
8trojan-lea...28.bat
windows7-x64
8trojan-lea...28.bat
windows10-2004-x64
8trojan-lea...28.exe
windows7-x64
8trojan-lea...28.exe
windows10-2004-x64
8trojan-lea...na.exe
windows7-x64
5trojan-lea...na.exe
windows10-2004-x64
5trojan-lea...um.exe
windows7-x64
8trojan-lea...um.exe
windows10-2004-x64
8trojan-lea...ty.exe
windows7-x64
1trojan-lea...ty.exe
windows10-2004-x64
1Resubmissions
09-05-2023 19:22
230509-x3fn4adg58 1009-05-2023 19:14
230509-xxsrgaff7x 1009-05-2023 19:14
230509-xxr5yadg42 709-05-2023 19:14
230509-xxrt6sff7w 809-05-2023 19:14
230509-xxrjeaff7v 809-05-2023 19:14
230509-xxqxwadg39 709-05-2023 19:14
230509-xxql4sff7t 1009-05-2023 19:14
230509-xxqbcadg38 709-05-2023 19:10
230509-xvl6xadf64 10Analysis
-
max time kernel
130s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2023 19:10
Behavioral task
behavioral1
Sample
trojan-leaks-main/Halloware (BerkayV).exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
trojan-leaks-main/Halloware (BerkayV).exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
trojan-leaks-main/HorrorTrojan123.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
trojan-leaks-main/HorrorTrojan123.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
trojan-leaks-main/InfiniteBlue.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
trojan-leaks-main/InfiniteBlue.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
trojan-leaks-main/Kirurg v2.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
trojan-leaks-main/Kirurg v2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
trojan-leaks-main/Kirurg.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
trojan-leaks-main/Kirurg.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
trojan-leaks-main/Kirurg_remsaterd.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
trojan-leaks-main/Kirurg_remsaterd.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
trojan-leaks-main/LogonFuck.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
trojan-leaks-main/LogonFuck.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
trojan-leaks-main/Mythlas.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
trojan-leaks-main/Mythlas.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
trojan-leaks-main/Phsyletric.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
trojan-leaks-main/Phsyletric.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
trojan-leaks-main/Potassium.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
trojan-leaks-main/Potassium.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
trojan-leaks-main/Protactinium.exe
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
trojan-leaks-main/Protactinium.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
trojan-leaks-main/QSO J1228+3128.bat
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
trojan-leaks-main/QSO J1228+3128.bat
Resource
win10v2004-20230221-en
Behavioral task
behavioral25
Sample
trojan-leaks-main/QSO J1228+3128.exe
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
trojan-leaks-main/QSO J1228+3128.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
trojan-leaks-main/Rebcoana.exe
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
trojan-leaks-main/Rebcoana.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
trojan-leaks-main/Ruthenium/Ruthenium.exe
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
trojan-leaks-main/Ruthenium/Ruthenium.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral31
Sample
trojan-leaks-main/Suffocate-safety.exe
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
trojan-leaks-main/Suffocate-safety.exe
Resource
win10v2004-20230220-en
General
-
Target
trojan-leaks-main/Kirurg_remsaterd.exe
-
Size
510KB
-
MD5
6dd7ecf13f87fa885fede29cd4d31127
-
SHA1
b9e133331ebccc6e97b90205de3801502637ce86
-
SHA256
50042ed8c6c60b2dd79a23bb6589f83cd6ac3971fba798e6d2a580d3fea8ebf2
-
SHA512
4cf4897f29b6e5048506ce30988052b7a600778a6648b9ab0eb2e5cc3f25521351cd70cbe5c5aac89a77c5b1af919f715cc163e400f38cadc25de9b8b77b23dc
-
SSDEEP
3072:nJvLB6pF8gO5sBWHYAraok57QbHk/CD+2UAYvU1Dzn+XwDaucnuvim695e/3lG:ncvAr5eQbH0w+pv6zn+XwDarnuvB/3
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Kirurg_remsaterd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation Kirurg_remsaterd.exe -
Executes dropped EXE 1 IoCs
Processes:
ScreenSaver.exepid process 2480 ScreenSaver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1552 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1552 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Kirurg_remsaterd.exedescription pid process target process PID 2104 wrote to memory of 2480 2104 Kirurg_remsaterd.exe ScreenSaver.exe PID 2104 wrote to memory of 2480 2104 Kirurg_remsaterd.exe ScreenSaver.exe PID 2104 wrote to memory of 2480 2104 Kirurg_remsaterd.exe ScreenSaver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Kirurg_remsaterd.exe"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Kirurg_remsaterd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe"C:\Users\Admin\AppData\Local\Temp\ScreenSaver.exe"2⤵
- Executes dropped EXE
PID:2480
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x530 0x5281⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5b5ff63f5352d3d79347f91737c5cd597
SHA13799699da69acf3e0c60921ca64272c84895ddd1
SHA2560c6b8001912c8bd44fc110278f62486868a8d60647363bc6b4ab0b84f901f319
SHA512115c44c042d237191ab1b612a8910f47db53b9b245f07307bf7efba3e459091c280e88ba9307e0d8a75329dac1529a2ddb858dd2426be3d66d94474c92aaefb4
-
Filesize
10KB
MD5b5ff63f5352d3d79347f91737c5cd597
SHA13799699da69acf3e0c60921ca64272c84895ddd1
SHA2560c6b8001912c8bd44fc110278f62486868a8d60647363bc6b4ab0b84f901f319
SHA512115c44c042d237191ab1b612a8910f47db53b9b245f07307bf7efba3e459091c280e88ba9307e0d8a75329dac1529a2ddb858dd2426be3d66d94474c92aaefb4
-
Filesize
10KB
MD5b5ff63f5352d3d79347f91737c5cd597
SHA13799699da69acf3e0c60921ca64272c84895ddd1
SHA2560c6b8001912c8bd44fc110278f62486868a8d60647363bc6b4ab0b84f901f319
SHA512115c44c042d237191ab1b612a8910f47db53b9b245f07307bf7efba3e459091c280e88ba9307e0d8a75329dac1529a2ddb858dd2426be3d66d94474c92aaefb4