Overview
overview
10Static
static
1FACTURA_1714631916.js
windows7-x64
10FACTURA_1714631916.js
windows10-2004-x64
10FACTURA_1478723101.js
windows7-x64
10FACTURA_1478723101.js
windows10-2004-x64
10FACTURA_3104517939.js
windows7-x64
10FACTURA_3104517939.js
windows10-2004-x64
10FACTURA_50862162.js
windows7-x64
10FACTURA_50862162.js
windows10-2004-x64
10PDF20218238767362.js
windows7-x64
10PDF20218238767362.js
windows10-2004-x64
10FACTURA_1324819148.js
windows7-x64
10FACTURA_1324819148.js
windows10-2004-x64
10PDF247791026727441.js
windows7-x64
10PDF247791026727441.js
windows10-2004-x64
101258293779...be.zip
windows7-x64
11258293779...be.zip
windows10-2004-x64
11258293779...d8.zip
windows7-x64
11258293779...d8.zip
windows10-2004-x64
11258293779...22.zip
windows7-x64
11258293779...22.zip
windows10-2004-x64
11258293779...af.zip
windows7-x64
11258293779...af.zip
windows10-2004-x64
11258293779...6b.zip
windows7-x64
11258293779...6b.zip
windows10-2004-x64
11258293779...0b.zip
windows7-x64
11258293779...0b.zip
windows10-2004-x64
11258293779...25.zip
windows7-x64
11258293779...25.zip
windows10-2004-x64
11258293779...13.zip
windows7-x64
11258293779...13.zip
windows10-2004-x64
11258293779...e2.zip
windows7-x64
11258293779...e2.zip
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
27/10/2023, 11:04
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA_1714631916.js
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
FACTURA_1714631916.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
FACTURA_1478723101.js
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
FACTURA_1478723101.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
FACTURA_3104517939.js
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
FACTURA_3104517939.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
FACTURA_50862162.js
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
FACTURA_50862162.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
PDF20218238767362.js
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
PDF20218238767362.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
FACTURA_1324819148.js
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
FACTURA_1324819148.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
PDF247791026727441.js
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
PDF247791026727441.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral15
Sample
12582937793/b88e361f5db949317650956480502f6391359798fd85c0341c8c43c30fc361be.zip
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
12582937793/b88e361f5db949317650956480502f6391359798fd85c0341c8c43c30fc361be.zip
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
12582937793/c1158c88f7951a14ff2436e679719e1b57d56002f1050b340b1fdd9bf37ee4d8.zip
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
12582937793/c1158c88f7951a14ff2436e679719e1b57d56002f1050b340b1fdd9bf37ee4d8.zip
Resource
win10v2004-20231020-en
Behavioral task
behavioral19
Sample
12582937793/ccd10d0c856a95beeffdd47f9e6530e71f23b2f3700c6fa609acfe262d5f1522.zip
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
12582937793/ccd10d0c856a95beeffdd47f9e6530e71f23b2f3700c6fa609acfe262d5f1522.zip
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
12582937793/cea14b7d1bffe66e3139930602537416b723f2b685e08d5680fc677c5730d4af.zip
Resource
win7-20231025-en
Behavioral task
behavioral22
Sample
12582937793/cea14b7d1bffe66e3139930602537416b723f2b685e08d5680fc677c5730d4af.zip
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
12582937793/cfd9efc4bcffd83c78da7165035918144b394a79b2fb60305f8993e35ee2986b.zip
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
12582937793/cfd9efc4bcffd83c78da7165035918144b394a79b2fb60305f8993e35ee2986b.zip
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
12582937793/d0fd7e32bf5ce2e1781ad484e03644d58122912eb5b88de3ffbf3fa12d09c80b.zip
Resource
win7-20231023-en
Behavioral task
behavioral26
Sample
12582937793/d0fd7e32bf5ce2e1781ad484e03644d58122912eb5b88de3ffbf3fa12d09c80b.zip
Resource
win10v2004-20231025-en
Behavioral task
behavioral27
Sample
12582937793/da6db77248718ea9cb22ea8b99d3030aa2838d241fdd2f64dbaaf60b02903f25.zip
Resource
win7-20231023-en
Behavioral task
behavioral28
Sample
12582937793/da6db77248718ea9cb22ea8b99d3030aa2838d241fdd2f64dbaaf60b02903f25.zip
Resource
win10v2004-20231020-en
Behavioral task
behavioral29
Sample
12582937793/da9a74db58c63c627e43a42e4b1f368cd13a34795e185414283393b9a4dcb813.zip
Resource
win7-20231020-en
Behavioral task
behavioral30
Sample
12582937793/da9a74db58c63c627e43a42e4b1f368cd13a34795e185414283393b9a4dcb813.zip
Resource
win10v2004-20231020-en
Behavioral task
behavioral31
Sample
12582937793/df041e0c1f5e2a8cbdf2b7c77c21cc8892a010172ee77ce9b1f63629e0fd9ee2.zip
Resource
win7-20231023-en
Behavioral task
behavioral32
Sample
12582937793/df041e0c1f5e2a8cbdf2b7c77c21cc8892a010172ee77ce9b1f63629e0fd9ee2.zip
Resource
win10v2004-20231023-en
General
-
Target
FACTURA_50862162.js
-
Size
5.9MB
-
MD5
06b78388e5785d4b2933672d4e9ded74
-
SHA1
fe7ce04cbcd5de3d4b17034149518c325441b6db
-
SHA256
0a2b6a17137991a8c39c1e7571ef211ed281fa7fc1d6691eba70bbacd40d739b
-
SHA512
64f02712551e733881978a84569f6d9eb27abfba4746f703d8b24894421d9f7ecb93bb91689a7faa197878231f659138f226f510d08ef02a8e57e4a03f7bb264
-
SSDEEP
49152:51yd7H3OYveKL0mtPYAlwXeri41LRWUbU1:1cc
Malware Config
Extracted
strela
193.109.85.77
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1332 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1332 regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2240 2416 wscript.exe 28 PID 2416 wrote to memory of 2240 2416 wscript.exe 28 PID 2416 wrote to memory of 2240 2416 wscript.exe 28 PID 2240 wrote to memory of 2056 2240 cmd.exe 30 PID 2240 wrote to memory of 2056 2240 cmd.exe 30 PID 2240 wrote to memory of 2056 2240 cmd.exe 30 PID 2240 wrote to memory of 1524 2240 cmd.exe 31 PID 2240 wrote to memory of 1524 2240 cmd.exe 31 PID 2240 wrote to memory of 1524 2240 cmd.exe 31 PID 2240 wrote to memory of 1332 2240 cmd.exe 32 PID 2240 wrote to memory of 1332 2240 cmd.exe 32 PID 2240 wrote to memory of 1332 2240 cmd.exe 32 PID 2240 wrote to memory of 1332 2240 cmd.exe 32 PID 2240 wrote to memory of 1332 2240 cmd.exe 32
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\FACTURA_50862162.js1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k copy "C:\Users\Admin\AppData\Local\Temp\FACTURA_50862162.js" "C:\Users\Admin\AppData\Local\Temp\\mercifullean.bat" && "C:\Users\Admin\AppData\Local\Temp\\mercifullean.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\findstr.exefindstr /V carelesspart ""C:\Users\Admin\AppData\Local\Temp\\mercifullean.bat""3⤵PID:2056
-
-
C:\Windows\system32\certutil.execertutil -f -decode spraydevelop tailstitch.dll3⤵PID:1524
-
-
C:\Windows\system32\regsvr32.exeregsvr32 tailstitch.dll3⤵
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1332
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD506b78388e5785d4b2933672d4e9ded74
SHA1fe7ce04cbcd5de3d4b17034149518c325441b6db
SHA2560a2b6a17137991a8c39c1e7571ef211ed281fa7fc1d6691eba70bbacd40d739b
SHA51264f02712551e733881978a84569f6d9eb27abfba4746f703d8b24894421d9f7ecb93bb91689a7faa197878231f659138f226f510d08ef02a8e57e4a03f7bb264
-
Filesize
5.9MB
MD506b78388e5785d4b2933672d4e9ded74
SHA1fe7ce04cbcd5de3d4b17034149518c325441b6db
SHA2560a2b6a17137991a8c39c1e7571ef211ed281fa7fc1d6691eba70bbacd40d739b
SHA51264f02712551e733881978a84569f6d9eb27abfba4746f703d8b24894421d9f7ecb93bb91689a7faa197878231f659138f226f510d08ef02a8e57e4a03f7bb264
-
Filesize
5.8MB
MD500e6818fc3c6403b9e01ada5c7fa0aad
SHA1bf9e6b1e58468109abab919553f7101e1a62ee8e
SHA256e6da9f6b5dd70333dd333c24fdd72e74ea1352fb0fdfa6ed8fa58f3a3afa286a
SHA512a05060086019d6455d458f79c631bb7d0b868b3bd57e9e2cef702e9ea73cd0c2996133fd7be30bc38c824719293f3ffe063008a1f2f26975efe80d2e749cc5aa
-
Filesize
4.4MB
MD511554db63b6bce5e73c385980d5bb0f4
SHA1f7b6a42212981b29ce90f9a92b9a83b30772f970
SHA256f99c9e0477e89dafc30d9b1c91c4ee08e5f27e72c0966fb7a44cf7a8f8457c2b
SHA512cec79e8f63012e5365441e289f4f5949b37b296f3a3d6fe60f27c37c1eca7334990b8a50d0aec60ac448aa1173be03b127c1a18fb96496093b341b76afff3982
-
Filesize
4.4MB
MD511554db63b6bce5e73c385980d5bb0f4
SHA1f7b6a42212981b29ce90f9a92b9a83b30772f970
SHA256f99c9e0477e89dafc30d9b1c91c4ee08e5f27e72c0966fb7a44cf7a8f8457c2b
SHA512cec79e8f63012e5365441e289f4f5949b37b296f3a3d6fe60f27c37c1eca7334990b8a50d0aec60ac448aa1173be03b127c1a18fb96496093b341b76afff3982