Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2023 23:16
Static task
static1
Behavioral task
behavioral1
Sample
2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe
Resource
win7-20230220-en
General
-
Target
2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe
-
Size
227KB
-
MD5
71cdc8400bfe18811d29425c2a9cb109
-
SHA1
031f46d4350785dd4d8ad9eaaed3ae8a410f3382
-
SHA256
2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e
-
SHA512
e019b3fb80112dab79bb6a2ce9d1bf9ba01f44da277d2399b9ae07d667f2601ddb243dd53f1b7495da0d4ee28ec2731d53916d23deb81b6d8ae40670d4c69fed
-
SSDEEP
3072:HfY/TU9fE9PEtuYbzKJbf9shCvCPBVfoZveo8spMN9g/m2oICCTobMaBB8NAL+6c:/Ya6Ez0bf9oCvCXAZ21sU6mCCVBMQu
Malware Config
Extracted
formbook
poub
WY0eksfISzRg4O6c+opnGL6gaw==
moRjn9ExtYi8UmUo+Tya
2vME+GedoxzFnuLXesUoVj4=
EvW4JWJ1NQ8nN3tA3SM=
2mK9efMZMgN1VOs=
8d0jua5b0J6AQEW7
/2cyThOd37DSTYMASDye4Q0t/Vs=
ral+tbIh2KKAQEW7
YLY9jsPtYB/FRmMo+Tya
R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=
KFXGg/T1pCC9GjrxUPTcjw==
8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=
c7am8nhhlCo=
UW91trZj6dENxuRdpxOvW1Cf
sjOMUcvq6lYJCZEfV4euFzY=
62nBgPjdmWQkmWElww==
64E8JqA1aruSUvw=
NqI1reXpcR+REye0
8+y1oOsbjgSyEhjXUPTcjw==
Rx9by8gNBwN1VOs=
Muif0yE4CQN1VOs=
VEt6//SsIukFo46EOTs=
Z8su52MYL67C
usDwuHRs8/KlWg==
idmltXXu7XAgHLE/UPTcjw==
QPrxO2shWNiGexGboHDSRqBQ1TBd
hq9rqBND8/KlWg==
QS9iHFx08/KlWg==
v1soVFoThEdt/B/dK0v4+6Wb
7rqJytN13KKAQEW7
OWbeN2SDJwonsI6EOTs=
aqQrrKZDm16GMlAtvxavW1Cf
imnEZWIEbC4M8Q+i
Bry3oQg5+6ZaUNxzwg==
B3vYmyxPQS5XYvmCsqQXX8X948Zf
KbGBmwwCyKTKsUcRUNN6CD61aw==
2WpDae4P+W4cdqc8kPBcjqg0wS1X
MvkZLPRY25jI
Alr0VZGxYxG3dR/zSNjBhQ==
ZJkdjczlrF+8l0Os
dcmMkFm+QhFD4OM=
fMdUrd4J1n4mmWElww==
Gat+k1fHg11vTQ==
sn+7Q4uxaAu9FyGv7k24F1DWaBEvmRI=
CjvGRTnXOhtN6QSNxhmvW1Cf
CpHvP2VSxaKAQEW7
qQWkEUJYFKhPttOZ4MarX8KKLl+/Jg==
GNVP4yIy8/KlWg==
pqfVAERhYxN7YPM=
9nS5b/AGCpZNAfZj1A==
a3GcpSND8/KlWg==
fin6NmQXayreIOrzPyw=
EjdROfeTsDPVH+rzPyw=
DO4xD8nURBwM8Q+i
+p/LQHFh0KOAQEW7
iNos10QpwjvjvFrXJYtYFiuHdA==
SX//aFP4Yi5T6NbcKQr07J6e
2NKh0dNr52sTdH4OSNjBhQ==
ZMSJmgsxFrlp5fnecrgeVYcP4xRZNho=
oXmlavAJ+3IbFbl3Gm4H+iKG
ijjWRYCaXiTcigreSNjBhQ==
ZqpH49I4XPu1k+rzPyw=
ZZUh+4FrrBbKukgJWoeuFzY=
lLnTxHn7rq/W9G8rzjsgCnyBYw==
drzjup.space
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1504-62-0x0000000000400000-0x000000000042C000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exepid process 928 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exedescription pid process target process PID 928 set thread context of 1504 928 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exepid process 1504 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exepid process 928 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exedescription pid process target process PID 928 wrote to memory of 1504 928 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe PID 928 wrote to memory of 1504 928 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe PID 928 wrote to memory of 1504 928 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe PID 928 wrote to memory of 1504 928 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe PID 928 wrote to memory of 1504 928 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe 2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe"C:\Users\Admin\AppData\Local\Temp\2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe"C:\Users\Admin\AppData\Local\Temp\2f629a402b16b6b5a6c223d27673a368507e018b6c526aa62815da9493337d7e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nstBB7.tmp\wywmmy.dllFilesize
5KB
MD569e275a60ff1f1093c9c28e9eaca6648
SHA1ce7fa683423c77d688a3a29abce7b23e989bd868
SHA2563714b8a9307d601b1e3dd239fe1dfffe20670d335951ac874473143a1034189a
SHA5122505e744fe964d0100b6f4edd788a33661abe19f87a2c69cd52d4b6cdc708383127bc05e968f0a939be1c5bd6ac081e6f985e8e28c378f8470844120376a817b
-
memory/1504-62-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1504-65-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB