Analysis

  • max time kernel
    31s
  • max time network
    41s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-06-2023 22:56

General

  • Target

    BruteForcers PACK/BruteForcers PACK/Brute Force SEO EVO2/EVO2.exe

  • Size

    146KB

  • MD5

    f765db7bb988f0e2fd314d52adc39ea0

  • SHA1

    eb315f0b2579e802be2cebda4ae89938d3c47685

  • SHA256

    4fccc754e19102242a982e1aa025fd4c1457cb6b277c3bab33ed1d7ea1dcd330

  • SHA512

    fdacc0cb87bbd80599746363ade50d3f47c44a27300b4d8bac8bc1763a9f59d274e80e5c4f56545efd397f162586371d1d01ac92276c2953fdb896312ac34a29

  • SSDEEP

    1536:UX4l5eP5VXdLXrnu2lAK/8n7cJCrHj899WZoZfKZKqK3YWPTnsxn0uIPE:UX4l50LPlroHj8XWZ0fmK5IHxn8M

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BruteForcers PACK\BruteForcers PACK\Brute Force SEO EVO2\EVO2.exe
    "C:\Users\Admin\AppData\Local\Temp\BruteForcers PACK\BruteForcers PACK\Brute Force SEO EVO2\EVO2.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Users\Admin\AppData\Local\Temp\BruteForcers PACK\BruteForcers PACK\Brute Force SEO EVO2\library\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\BruteForcers PACK\BruteForcers PACK\Brute Force SEO EVO2\library\Launcher.exe"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3916
      • C:\Windows\IMF\Windows Services.exe
        "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\IMF\Secure System Shell.exe
          "C:\Windows\IMF\Secure System Shell.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2744
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3388

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wf2d5szn.wt3.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Windows\IMF\Runtime Explorer.exe

    Filesize

    144KB

    MD5

    ec70c6f4dc443c5ab2b91d64ae04fa8e

    SHA1

    43eb3b3289782fced204f0b4e3edad2ba1b085b7

    SHA256

    276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d

    SHA512

    6217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584

  • C:\Windows\IMF\Runtime Explorer.exe

    Filesize

    144KB

    MD5

    ec70c6f4dc443c5ab2b91d64ae04fa8e

    SHA1

    43eb3b3289782fced204f0b4e3edad2ba1b085b7

    SHA256

    276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d

    SHA512

    6217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584

  • C:\Windows\IMF\Runtime Explorer.exe

    Filesize

    144KB

    MD5

    ec70c6f4dc443c5ab2b91d64ae04fa8e

    SHA1

    43eb3b3289782fced204f0b4e3edad2ba1b085b7

    SHA256

    276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d

    SHA512

    6217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584

  • C:\Windows\IMF\Secure System Shell.exe

    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

  • C:\Windows\IMF\Secure System Shell.exe

    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

  • C:\Windows\IMF\Secure System Shell.exe

    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

  • C:\Windows\IMF\Windows Services.exe

    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

  • C:\Windows\IMF\Windows Services.exe

    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

  • C:\Windows\IMF\Windows Services.exe

    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

  • memory/2560-199-0x0000000000EE0000-0x0000000000EF2000-memory.dmp

    Filesize

    72KB

  • memory/2560-201-0x0000000005690000-0x00000000056A0000-memory.dmp

    Filesize

    64KB

  • memory/2560-234-0x0000000005690000-0x00000000056A0000-memory.dmp

    Filesize

    64KB

  • memory/2744-219-0x0000000000220000-0x0000000000232000-memory.dmp

    Filesize

    72KB

  • memory/2744-235-0x0000000004A50000-0x0000000004A60000-memory.dmp

    Filesize

    64KB

  • memory/2744-225-0x0000000004A50000-0x0000000004A60000-memory.dmp

    Filesize

    64KB

  • memory/3772-183-0x0000000005C90000-0x0000000005D06000-memory.dmp

    Filesize

    472KB

  • memory/3772-140-0x0000000000100000-0x0000000000114000-memory.dmp

    Filesize

    80KB

  • memory/3772-141-0x0000000004A50000-0x0000000004A60000-memory.dmp

    Filesize

    64KB

  • memory/3772-146-0x0000000004A50000-0x0000000004A60000-memory.dmp

    Filesize

    64KB

  • memory/3772-142-0x0000000005FD0000-0x000000000604E000-memory.dmp

    Filesize

    504KB

  • memory/3772-184-0x0000000005C70000-0x0000000005C8E000-memory.dmp

    Filesize

    120KB

  • memory/3916-203-0x0000000004980000-0x0000000004990000-memory.dmp

    Filesize

    64KB

  • memory/3916-202-0x000000007F9D0000-0x000000007F9E0000-memory.dmp

    Filesize

    64KB

  • memory/3916-144-0x0000000004FC0000-0x00000000055E8000-memory.dmp

    Filesize

    6.2MB

  • memory/3916-145-0x0000000004EA0000-0x0000000004EC2000-memory.dmp

    Filesize

    136KB

  • memory/3916-161-0x0000000005D50000-0x0000000005D6E000-memory.dmp

    Filesize

    120KB

  • memory/3916-152-0x00000000056A0000-0x0000000005706000-memory.dmp

    Filesize

    408KB

  • memory/3916-155-0x0000000004980000-0x0000000004990000-memory.dmp

    Filesize

    64KB

  • memory/3916-200-0x0000000006D40000-0x0000000006D72000-memory.dmp

    Filesize

    200KB

  • memory/3916-143-0x0000000002440000-0x0000000002476000-memory.dmp

    Filesize

    216KB

  • memory/3916-224-0x00000000070D0000-0x00000000070DA000-memory.dmp

    Filesize

    40KB

  • memory/3916-153-0x0000000004980000-0x0000000004990000-memory.dmp

    Filesize

    64KB

  • memory/3916-204-0x000000006F890000-0x000000006F8DC000-memory.dmp

    Filesize

    304KB

  • memory/3916-214-0x0000000006300000-0x000000000631E000-memory.dmp

    Filesize

    120KB

  • memory/3916-229-0x0000000007380000-0x0000000007388000-memory.dmp

    Filesize

    32KB

  • memory/3916-228-0x00000000073A0000-0x00000000073BA000-memory.dmp

    Filesize

    104KB

  • memory/3916-227-0x0000000007290000-0x000000000729E000-memory.dmp

    Filesize

    56KB

  • memory/3916-226-0x00000000072E0000-0x0000000007376000-memory.dmp

    Filesize

    600KB

  • memory/3916-156-0x0000000005710000-0x0000000005776000-memory.dmp

    Filesize

    408KB

  • memory/3916-222-0x00000000076B0000-0x0000000007D2A000-memory.dmp

    Filesize

    6.5MB

  • memory/3916-223-0x0000000007060000-0x000000000707A000-memory.dmp

    Filesize

    104KB

  • memory/5036-139-0x00000000053B0000-0x0000000005406000-memory.dmp

    Filesize

    344KB

  • memory/5036-135-0x0000000005760000-0x0000000005D04000-memory.dmp

    Filesize

    5.6MB

  • memory/5036-133-0x0000000000800000-0x000000000082A000-memory.dmp

    Filesize

    168KB

  • memory/5036-136-0x00000000051B0000-0x0000000005242000-memory.dmp

    Filesize

    584KB

  • memory/5036-137-0x0000000005050000-0x0000000005060000-memory.dmp

    Filesize

    64KB

  • memory/5036-138-0x00000000050A0000-0x00000000050AA000-memory.dmp

    Filesize

    40KB

  • memory/5036-232-0x0000000005050000-0x0000000005060000-memory.dmp

    Filesize

    64KB

  • memory/5036-233-0x0000000005050000-0x0000000005060000-memory.dmp

    Filesize

    64KB

  • memory/5036-134-0x0000000005110000-0x00000000051AC000-memory.dmp

    Filesize

    624KB

  • memory/5036-154-0x0000000005050000-0x0000000005060000-memory.dmp

    Filesize

    64KB