Analysis
-
max time kernel
29s -
max time network
74s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2023 06:01
Static task
static1
Behavioral task
behavioral1
Sample
bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe
Resource
win10-20230703-en
Behavioral task
behavioral2
Sample
bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe
Resource
win10v2004-20230703-en
General
-
Target
bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe
-
Size
138KB
-
MD5
f62bb82db62dd6b80908dcd79ea51fb2
-
SHA1
e635ba1b935adf31ffd055d71884098567b3dd4f
-
SHA256
bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
-
SHA512
869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
SSDEEP
3072:dsFd0klDWOsja1mrT0CowNJ8s540uUf0WccH2hgcD:QWHrYNwNeQEBgc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
RthfOCoLflan.exepid process 4100 RthfOCoLflan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exedescription pid process target process PID 1548 wrote to memory of 4100 1548 bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe RthfOCoLflan.exe PID 1548 wrote to memory of 4100 1548 bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe RthfOCoLflan.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe"C:\Users\Admin\AppData\Local\Temp\bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RthfOCoLflan.exe"C:\Users\Admin\AppData\Local\Temp\RthfOCoLflan.exe" 8 LAN2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BiefZxsFBlan.exe"C:\Users\Admin\AppData\Local\Temp\BiefZxsFBlan.exe" 8 LAN2⤵
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BiefZxsFBlan.exeFilesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
C:\Users\Admin\AppData\Local\Temp\BiefZxsFBlan.exeFilesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
C:\Users\Admin\AppData\Local\Temp\RthfOCoLflan.exeFilesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
C:\Users\Admin\AppData\Local\Temp\RthfOCoLflan.exeFilesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
C:\Users\Admin\AppData\Local\Temp\RthfOCoLflan.exeFilesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
memory/2436-151-0x00007FF6365D0000-0x00007FF636734000-memory.dmpFilesize
1.4MB
-
memory/2468-152-0x00007FF6365D0000-0x00007FF636734000-memory.dmpFilesize
1.4MB