Resubmissions

19-12-2023 11:13

231219-nbvjhaadcp 10

19-12-2023 10:58

231219-m2x7msgfbp 10

17-12-2023 09:31

231217-lhgj4sfef4 10

18-10-2023 12:14

231018-pem49sfg83 10

Analysis

  • max time kernel
    128s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-10-2023 12:14

General

  • Target

    1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe

  • Size

    14.9MB

  • MD5

    97abffeaa7bdfaa81532bd6028498225

  • SHA1

    26ab576a0abf7085ecf6321a311a7b3088ee48ae

  • SHA256

    1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e

  • SHA512

    af271b15a4f64ac4965cc75f7531e28d3ea0abc90d16ae4654251a301d1a3a0b10d80b205dc626b8866c976ffacdace74f71711c73ef1240d867aeb09c47cc75

  • SSDEEP

    196608:aMygJ9edfbhSo5Kp8qPKlL8QgYVhqhOM8qTsSqwLM:7XJ9e1wo548qSV5VhKOeTsRwLM

Malware Config

Signatures

  • Azov

    A wiper seeking only damage, first seen in 2022.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
    "C:\Users\Admin\AppData\Local\Temp\1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    PID:1796

Network

  • flag-us
    DNS
    158.240.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    158.240.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.126.166.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.126.166.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.81.21.72.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.81.21.72.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    108.211.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    108.211.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    63.141.182.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    63.141.182.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    158.240.127.40.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    158.240.127.40.in-addr.arpa

  • 8.8.8.8:53
    56.126.166.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    56.126.166.20.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    240.81.21.72.in-addr.arpa
    dns
    71 B
    142 B
    1
    1

    DNS Request

    240.81.21.72.in-addr.arpa

  • 8.8.8.8:53
    68.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    68.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    108.211.229.192.in-addr.arpa
    dns
    74 B
    145 B
    1
    1

    DNS Request

    108.211.229.192.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    63.141.182.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    63.141.182.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1796-1-0x0000000000830000-0x0000000000834000-memory.dmp

    Filesize

    16KB

  • memory/1796-0-0x0000000000800000-0x0000000000807000-memory.dmp

    Filesize

    28KB

  • memory/1796-2-0x0000000000820000-0x0000000000825000-memory.dmp

    Filesize

    20KB

  • memory/1796-6-0x0000000000830000-0x0000000000834000-memory.dmp

    Filesize

    16KB

  • memory/1796-7-0x0000000000820000-0x0000000000825000-memory.dmp

    Filesize

    20KB

  • memory/1796-4-0x0000000140000000-0x000000014003E000-memory.dmp

    Filesize

    248KB

  • memory/1796-8-0x0000000000820000-0x0000000000825000-memory.dmp

    Filesize

    20KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.