Analysis
-
max time kernel
1565s -
max time network
1567s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 18:48
Static task
static1
Behavioral task
behavioral1
Sample
AIMr.py
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
AIMr.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
config.py
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
config.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
library.py
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
library.py
Resource
win10v2004-20231222-en
General
-
Target
library.py
-
Size
14KB
-
MD5
9c016391784db9c89a53fd77df0b16a5
-
SHA1
5c747beedcbc62c8c5de11d9ab0a215c9e5296cf
-
SHA256
5068dd0caefe8918450ee1156d7e8651ffdeed49999db02de9566106341e79a8
-
SHA512
7fd75840c3feddda4e12669aeac54f7b135ed8992dcf86045da6eea9f08cca0adcca8ba9ef30a62136ff4a79b2d06939b5ce985c2a630ab58283ff2829175511
-
SSDEEP
384:3jyIND80zqelp6pnCy3MBmfhCAz2tdcbc/q:3j1uikYmJ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2948 wrote to memory of 2608 2948 cmd.exe rundll32.exe PID 2948 wrote to memory of 2608 2948 cmd.exe rundll32.exe PID 2948 wrote to memory of 2608 2948 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\library.py1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\library.py2⤵
- Modifies registry class
PID:2608
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2888