Overview
overview
10Static
static
10The-MALWAR...ot.exe
windows11-21h2-x64
3The-MALWAR...ll.exe
windows11-21h2-x64
10The-MALWAR...BS.exe
windows11-21h2-x64
10The-MALWAR...in.exe
windows11-21h2-x64
7The-MALWAR....A.exe
windows11-21h2-x64
1The-MALWAR....A.exe
windows11-21h2-x64
10The-MALWAR....A.dll
windows11-21h2-x64
6The-MALWAR...r.xlsm
windows11-21h2-x64
10The-MALWAR...36c859
windows11-21h2-x64
1The-MALWAR...caa742
windows11-21h2-x64
1The-MALWAR...c1a732
windows11-21h2-x64
1The-MALWAR...57c046
windows11-21h2-x64
1The-MALWAR...4cde86
windows11-21h2-x64
1The-MALWAR...460a01
windows11-21h2-x64
1The-MALWAR...ece0c5
windows11-21h2-x64
1The-MALWAR...257619
windows11-21h2-x64
1The-MALWAR...fbcc59
windows11-21h2-x64
1The-MALWAR...54f69c
windows11-21h2-x64
1The-MALWAR...d539a6
windows11-21h2-x64
1The-MALWAR...4996dd
windows11-21h2-x64
1The-MALWAR...8232d5
windows11-21h2-x64
1The-MALWAR...66b948
windows11-21h2-x64
1The-MALWAR...f9db86
windows11-21h2-x64
1The-MALWAR...ea2485
windows11-21h2-x64
1The-MALWAR...us.exe
windows11-21h2-x64
6The-MALWAR....a.exe
windows11-21h2-x64
1The-MALWAR....a.exe
windows11-21h2-x64
7The-MALWAR...ok.exe
windows11-21h2-x64
1The-MALWAR...y.html
windows11-21h2-x64
1The-MALWAR...ft.exe
windows11-21h2-x64
4The-MALWAR...en.exe
windows11-21h2-x64
6The-MALWAR...min.js
windows11-21h2-x64
1Analysis
-
max time kernel
1790s -
max time network
1748s -
platform
windows11-21h2_x64 -
resource
win11-20231129-en -
resource tags
arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-12-2023 17:56
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Banking-Malware/Zloader.xlsm
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/001eb377f0452060012124cb214f658754c7488ccb82e23ec56b2f45a636c859
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/041bc20ca8ac3161098cbc976e67e3c0f1b672ad36ecbe22fd21cbd53bcaa742
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/2378e76aba1ad6e0c937fb39989217bf0de616fdad4726c0f4233bf5414cde86
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/30c150419000d27dafcd5d00702411b2b23b0f5d7e4d0cc729a7d63b2e460a01
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/3205603282a636979a55aa1e1be518cd3adcbbe491745d996ceb4b5a4dece0c5
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/453468b86856665f2cc0e0e71668c0b6aac8b14326c623995ba5963f22257619
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/7745b070943e910e8807e3521ac7b7a01401d131bf6c18a63433f8177ed539a6
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/7f18e5b5b7645a80a0d44adf3fecdafcbf937bfe30a4cfb965a1421e034996dd
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/90b61cc77bb2d726219fd00ae2d0ecdf6f0fe7078529e87b7ec8e603008232d5
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/9384b9e39334479194aacb53cb25ace289b6afe2e41bdc8619b2d2cae966b948
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Botnets/FritzFrog/d1e82d4a37959a9e6b661e31b8c8c6d2813c93ac92508a2771b2491b04ea2485
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Email-Worm/Amus.exe
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Email-Worm/Anap.a.exe
Resource
win11-20231128-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Email-Worm/Brontok.exe
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Email-Worm/BubbleBoy.html
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Email-Worm/Bugsoft.exe
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Email-Worm/Duksten.exe
Resource
win11-20231129-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Email-Worm/Emin.js
Resource
win11-20231128-en
windows11-21h2-x64
General
-
Target
The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
-
Size
11KB
-
MD5
0fbf8022619ba56c545b20d172bf3b87
-
SHA1
752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
-
SHA256
4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
-
SHA512
e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb
-
SSDEEP
192:33K8Vn5fAIBkPA9tQdEnhAv+mKqh1RwE9gCOMv8eIry2aZoa5qq/:33X54IB8SCY2W3qmSgaIrTDSqq/
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.a.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysaxam32 = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe" Axam.a.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Edonkey2000\Incoming\setup_flash.exe Axam.a.exe File created C:\Program Files (x86)\limewire\Shared\Super Mario.exe Axam.a.exe File created C:\Program Files (x86)\KMD\My Shared Folder\Axam.exe Axam.a.exe File created C:\Program Files (x86)\Kazaa\My Shared Folder\Invisible_man.exe Axam.a.exe File created C:\Program Files (x86)\KaZaA Lite\My Shared Folder\AjeedNASA.exe Axam.a.exe File created C:\Program Files (x86)\Morpheus\My Shared Folder\Blaster.exe Axam.a.exe File created C:\Program Files (x86)\Grokster\My Grokster\XXX_HOTSEX.exe Axam.a.exe File created C:\Program Files (x86)\BearShare\Shared\fxbgbear.exe Axam.a.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon\ = "%1" Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe \"%1\" %*" Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "Spitmaxa" Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon Axam.a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe 3204 Axam.a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3204 Axam.a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Axam.a.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Axam.a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD50fbf8022619ba56c545b20d172bf3b87
SHA1752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
SHA2564ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
SHA512e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb