Overview
overview
10Static
static
10xm.gz
windows7-x64
3xm.gz
windows10-2004-x64
7sample.tar
windows7-x64
3sample.tar
windows10-2004-x64
7aarch64
ubuntu-18.04-amd64
6create
ubuntu-18.04-amd64
7create
debian-9-armhf
7create
debian-9-mips
1create
debian-9-mipsel
1hide
ubuntu-18.04-amd64
1hide.c
windows7-x64
3hide.c
windows10-2004-x64
3init
ubuntu-18.04-amd64
3mining
ubuntu-18.04-amd64
6mining
debian-9-armhf
6mining
debian-9-mips
6mining
debian-9-mipsel
6mkcfg
ubuntu-18.04-amd64
1mkcfg
debian-9-armhf
1mkcfg
debian-9-mips
1mkcfg
debian-9-mipsel
1start
ubuntu-18.04-amd64
10start
debian-9-armhf
1start
debian-9-mips
1start
debian-9-mipsel
1x86_64
ubuntu-18.04-amd64
6Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20/12/2023, 05:19
Behavioral task
behavioral1
Sample
xm.gz
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
xm.gz
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
sample.tar
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
sample.tar
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
aarch64
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral6
Sample
create
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral7
Sample
create
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral8
Sample
create
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral9
Sample
create
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral10
Sample
hide
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral11
Sample
hide.c
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
hide.c
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
init
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral14
Sample
mining
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral15
Sample
mining
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral16
Sample
mining
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral17
Sample
mining
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral18
Sample
mkcfg
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral19
Sample
mkcfg
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral20
Sample
mkcfg
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral21
Sample
mkcfg
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral22
Sample
start
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral23
Sample
start
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral24
Sample
start
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral25
Sample
start
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral26
Sample
x86_64
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
hide.c
-
Size
8KB
-
MD5
0ea36d63bdc19596106ffab97991e916
-
SHA1
3f0884d86a24ae678ea6e4f13a3f1dc1aced8a0d
-
SHA256
b1f5032c0abab0e185b90a5cacaecd6af2d10974ea2a8f9676732413bcff1424
-
SHA512
2decede4480cdd408bb37d7a82f229ce4c51923690f91ddbb7dc2e5faf17aad50d083a439ec05e021e0309bf845354146dc3aa50c7845c55fedaedab0fa78912
-
SSDEEP
96:ViUsLKDZd6ubi/9L4PLMtNuJ7tS8/Xjfo5:ViULD9i/duQY/XM5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\c_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\c_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.c rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\c_auto_file\shell\open\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\c_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.c\ = "c_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\c_auto_file\shell\edit rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\c_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\c_auto_file\shell\edit\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\c_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\c_auto_file\shell\open rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2744 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2784 wrote to memory of 3012 2784 cmd.exe 29 PID 2784 wrote to memory of 3012 2784 cmd.exe 29 PID 2784 wrote to memory of 3012 2784 cmd.exe 29 PID 3012 wrote to memory of 2744 3012 rundll32.exe 30 PID 3012 wrote to memory of 2744 3012 rundll32.exe 30 PID 3012 wrote to memory of 2744 3012 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\hide.c1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\hide.c2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\hide.c3⤵
- Opens file in notepad (likely ransom note)
PID:2744
-
-