Overview
overview
7Static
static
1Betflix-4....m).apk
android-9-x86
7Betflix-4....m).apk
android-11-x64
7CaviarDreams.ttf
windows7-x64
3CaviarDreams.ttf
windows10-2004-x64
7Pacifico.ttf
windows7-x64
3Pacifico.ttf
windows10-2004-x64
7Sansation-Regular.ttf
windows7-x64
3Sansation-Regular.ttf
windows10-2004-x64
7Walkway_Bold.ttf
windows7-x64
3Walkway_Bold.ttf
windows10-2004-x64
7audience_network.dex
windows7-x64
3audience_network.dex
windows10-2004-x64
3crear_tran...n.html
windows7-x64
1crear_tran...n.html
windows10-2004-x64
1sound2.wav
windows7-x64
1sound2.wav
windows10-2004-x64
6sound3.wav
windows7-x64
1sound3.wav
windows10-2004-x64
6sound4.wav
windows7-x64
1sound4.wav
windows10-2004-x64
6sound5.wav
windows7-x64
1sound5.wav
windows10-2004-x64
6sound_out2.wav
windows7-x64
1sound_out2.wav
windows10-2004-x64
6sound_out3.wav
windows7-x64
1sound_out3.wav
windows10-2004-x64
6sound_out4.wav
windows7-x64
1sound_out4.wav
windows10-2004-x64
6sound_out5.wav
windows7-x64
1sound_out5.wav
windows10-2004-x64
6Analysis
-
max time kernel
77s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2023 18:41
Static task
static1
Behavioral task
behavioral1
Sample
Betflix-4.2(betflixapk.com).apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
Betflix-4.2(betflixapk.com).apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral3
Sample
CaviarDreams.ttf
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
CaviarDreams.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Pacifico.ttf
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Pacifico.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Sansation-Regular.ttf
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Sansation-Regular.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Walkway_Bold.ttf
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Walkway_Bold.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
audience_network.dex
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
audience_network.dex
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
crear_transaction.html
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
crear_transaction.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
sound2.wav
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
sound2.wav
Resource
win10v2004-20230221-en
Behavioral task
behavioral17
Sample
sound3.wav
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
sound3.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
sound4.wav
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
sound4.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
sound5.wav
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
sound5.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
sound_out2.wav
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
sound_out2.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
sound_out3.wav
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
sound_out3.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
sound_out4.wav
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
sound_out4.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
sound_out5.wav
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
sound_out5.wav
Resource
win10v2004-20230221-en
General
-
Target
sound2.wav
-
Size
59KB
-
MD5
1d3e701c3b7ccac6eb9915ab0488f569
-
SHA1
ffb9ac94e334d21cfc1c156059f7f993ad7c357f
-
SHA256
c6107f9102e8e02b31caf15dd1b75682e651202cf9ce6b52d5b7b23ac243fad2
-
SHA512
91b2be1dab135f8d0927f59b494435f2627ac26c2285ec83dae6fe4029c50dc2f30df59809210743088b58d6f309efca31c793e3f40f1e60f08f51c0d69907f1
-
SSDEEP
1536:xUkAcuYUgWYD+dNv3lg3xxx+0s9CswsMQOMk19:xjAdYoa+dNQWv9MsCMk19
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
unregmp2.exedescription ioc process File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
unregmp2.exedescription pid process Token: SeShutdownPrivilege 4876 unregmp2.exe Token: SeCreatePagefilePrivilege 4876 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
wmplayer.exeunregmp2.exedescription pid process target process PID 3888 wrote to memory of 3516 3888 wmplayer.exe setup_wm.exe PID 3888 wrote to memory of 3516 3888 wmplayer.exe setup_wm.exe PID 3888 wrote to memory of 3516 3888 wmplayer.exe setup_wm.exe PID 3888 wrote to memory of 4216 3888 wmplayer.exe unregmp2.exe PID 3888 wrote to memory of 4216 3888 wmplayer.exe unregmp2.exe PID 3888 wrote to memory of 4216 3888 wmplayer.exe unregmp2.exe PID 4216 wrote to memory of 4876 4216 unregmp2.exe unregmp2.exe PID 4216 wrote to memory of 4876 4216 unregmp2.exe unregmp2.exe
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\sound2.wav"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\sound2.wav"2⤵
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
256KB
MD52936527c6171be1065c6012a3e8ffddd
SHA19273557d3cfc6987eac30802569e9d2579d7d4a4
SHA256e341ab7fd265205d2477cb5234a6c3d35911d7ebb17139b585b55eb7def237e0
SHA512a83203b4696232299c70ff0f7ae292964417b0636d278544fd252a41e6ab3b5c749e836d83d7b22bc52d56dc069bb8caa0ebf5634b32e3acae7afc87c1215e5d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bakFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
1KB
MD5654eab7a54ea1d2fae7c5eff796732da
SHA1032514d26dd137c4b07bc11b887c21f2e06c0f02
SHA256413388c873e37c3f5bb5ae5c477b261480413ed58f253505ebba96420b20d90c
SHA51274b999b12b050c008b4c1665f7f8af2881175f94c4e2405ab15455b2c524ba1523dce09e1019ce608abd904935f02ba728b9e005902636fb7d1006bd6b8cad7d