e652ab2e1240fc9a3bf5513c56881a021ed316a62710e785591b45d9fe566958

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ULTRAKILL[dlIOG23Nr].exe
Size

71.8MB
MD5

42e2e1416f18599c95b50158f9c8a323
SHA1

4f3350f0dfc0830a1665f990ffcfb42f4fbd963d
SHA256

e652ab2e1240fc9a3bf5513c56881a021ed316a62710e785591b45d9fe566958
SHA512

7def242b92ce83771008e26127fc93ffade74020e382ab030b68c0d944b805a682685ed0238a68a22f13754408e8c691fd365f7f365fa054140992319d81a787
SSDEEP

1572864:UGaIDlyjZbGAavxWTgw631bfq/fsWHmNV6qcJMGf:UG3ZfAuIg1fKffHmU

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
3012	ULTRAKILL[dlIOG23Nr].exe
3012	ULTRAKILL[dlIOG23Nr].exe
3012	ULTRAKILL[dlIOG23Nr].exe
3012	ULTRAKILL[dlIOG23Nr].exe
3012	ULTRAKILL[dlIOG23Nr].exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\ULTRAKILL[dlIOG23Nr].exe
"C:\Users\Admin\AppData\Local\Temp\ULTRAKILL[dlIOG23Nr].exe"
1⤵
- Loads dropped DLL
PID:3012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsfD311.tmp\ButtonEvent.dll

Filesize
5KB

MD5
c24568a3b0d7c8d7761e684eb77252b5

SHA1
66db7f147cbc2309d8d78fdce54660041acbc60d

SHA256
e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

SHA512
5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD311.tmp\System.dll

Filesize
13KB

MD5
1193ba8d4a2e97edf6422553c5ec56c7

SHA1
8ef5a334288384d33ec96fde5e7b052eca442873

SHA256
b4629797df776519dfd917f8c5f20e6aa02e2a4851833106332a6cbffd281bb1

SHA512
0178c816c622c15c2c40e4e531b669f6e041a164fb91a068e4aaf2419011e5d86efcf579e0a389d7f5e38cec25a7c20e4f059e7392c24a268be7e421d0201780

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD311.tmp\UAC.dll

Filesize
18KB

MD5
113c5f02686d865bc9e8332350274fd1

SHA1
4fa4414666f8091e327adb4d81a98a0d6e2e254a

SHA256
0d21041a1b5cd9f9968fc1d457c78a802c9c5a23f375327e833501b65bcd095d

SHA512
e190d1ee50c0b2446b14f0d9994a0ce58f5dbd2aa5d579f11b3a342da1d4abf0f833a0415d3817636b237930f314be54e4c85b4db4a9b4a3e532980ea9c91284

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD311.tmp\nsDialogs.dll

Filesize
11KB

MD5
42314ae76e917f74ebf36d183b13e06b

SHA1
9d278a7efe30717faf2ffa04d0f9cc11462043d4

SHA256
ae347f6f01d83db36b36615a08e93e183aa4446d772bee87dadccd16123e2aa4

SHA512
e08d906b87f2b00d84466a171debbdd206e5cbe7d342672778304d67fd86df9a47587af622bd800ba7fb3bf5fbba2215661117cc7ac6832a4ba32a2962a991f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsfD311.tmp\nsJSON.dll

Filesize
23KB

MD5
f4d89d9a2a3e2f164aea3e93864905c9

SHA1
4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a

SHA256
64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb

SHA512
dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2

Download Submit