Analysis
- max time kernel
149s - max time network
153s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
21/02/2024, 03:49
Static task
static1
Behavioral task
behavioral1
Sample
9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe
Resource
win7-20231215-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe
- Size 1.0MB
- Sample240221-edjeksba2x
- SHA256 9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88
- MD5 4334e838a1ad1e35a533d8ff6d55ea3d
- SHA1 cb617e4af09ee90e8918fb7488337a935750a318
- SHA512 0e107f77986171d13358eb780fbb3c243f1f4afbbfe5f615172e15de2bc1948932b82e592abedb03262444c81ebc86e1e2bfe7fffb3f964289a31c2f5e863dff
- SSDEEP 24576:0z28lByb3DFSo0hs6vZ0MZ0ZvJPqljO35FhAJacjuFlewy:0K8vommMtZO35FoQm
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 2696 created 1260 2696 Memo.pif 22 PID 2696 created 1260 2696 Memo.pif 22 - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule behavioral1/memory/692-52-0x0000000000400000-0x00000000004B4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
resource yara_rule behavioral1/memory/692-52-0x0000000000400000-0x00000000004B4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral1/memory/692-52-0x0000000000400000-0x00000000004B4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Detects executables referencing credit card regular expressions 1 IoCs
resource yara_rule behavioral1/memory/692-52-0x0000000000400000-0x00000000004B4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_CC_Regex - Downloads MZ/PE file
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url cmd.exe - Executes dropped EXE 1 IoCs
pid Process 2696 Memo.pif - Loads dropped DLL 1 IoCs
pid Process 2728 cmd.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2696 set thread context of 692 2696 Memo.pif 51 PID 2696 set thread context of 524 2696 Memo.pif 50 PID 2696 set thread context of 3008 2696 Memo.pif 55 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2804 schtasks.exe - Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2780 tasklist.exe 2848 tasklist.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 2168 PING.EXE - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 2780 tasklist.exe Token: SeDebugPrivilege 2848 tasklist.exe Token: SeIncreaseQuotaPrivilege 2560 WMIC.exe Token: SeSecurityPrivilege 2560 WMIC.exe Token: SeTakeOwnershipPrivilege 2560 WMIC.exe Token: SeLoadDriverPrivilege 2560 WMIC.exe Token: SeSystemProfilePrivilege 2560 WMIC.exe Token: SeSystemtimePrivilege 2560 WMIC.exe Token: SeProfSingleProcessPrivilege 2560 WMIC.exe Token: SeIncBasePriorityPrivilege 2560 WMIC.exe Token: SeCreatePagefilePrivilege 2560 WMIC.exe Token: SeBackupPrivilege 2560 WMIC.exe Token: SeRestorePrivilege 2560 WMIC.exe Token: SeShutdownPrivilege 2560 WMIC.exe Token: SeDebugPrivilege 2560 WMIC.exe Token: SeSystemEnvironmentPrivilege 2560 WMIC.exe Token: SeRemoteShutdownPrivilege 2560 WMIC.exe Token: SeUndockPrivilege 2560 WMIC.exe Token: SeManageVolumePrivilege 2560 WMIC.exe Token: 33 2560 WMIC.exe Token: 34 2560 WMIC.exe Token: 35 2560 WMIC.exe Token: SeIncreaseQuotaPrivilege 2560 WMIC.exe Token: SeSecurityPrivilege 2560 WMIC.exe Token: SeTakeOwnershipPrivilege 2560 WMIC.exe Token: SeLoadDriverPrivilege 2560 WMIC.exe Token: SeSystemProfilePrivilege 2560 WMIC.exe Token: SeSystemtimePrivilege 2560 WMIC.exe Token: SeProfSingleProcessPrivilege 2560 WMIC.exe Token: SeIncBasePriorityPrivilege 2560 WMIC.exe Token: SeCreatePagefilePrivilege 2560 WMIC.exe Token: SeBackupPrivilege 2560 WMIC.exe Token: SeRestorePrivilege 2560 WMIC.exe Token: SeShutdownPrivilege 2560 WMIC.exe Token: SeDebugPrivilege 2560 WMIC.exe Token: SeSystemEnvironmentPrivilege 2560 WMIC.exe Token: SeRemoteShutdownPrivilege 2560 WMIC.exe Token: SeUndockPrivilege 2560 WMIC.exe Token: SeManageVolumePrivilege 2560 WMIC.exe Token: 33 2560 WMIC.exe Token: 34 2560 WMIC.exe Token: 35 2560 WMIC.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2696 Memo.pif 2696 Memo.pif 2696 Memo.pif - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2728 1684 9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe 29 PID 1684 wrote to memory of 2728 1684 9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe 29 PID 1684 wrote to memory of 2728 1684 9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe 29 PID 1684 wrote to memory of 2728 1684 9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe 29 PID 2728 wrote to memory of 2780 2728 cmd.exe 31 PID 2728 wrote to memory of 2780 2728 cmd.exe 31 PID 2728 wrote to memory of 2780 2728 cmd.exe 31 PID 2728 wrote to memory of 2780 2728 cmd.exe 31 PID 2728 wrote to memory of 2748 2728 cmd.exe 32 PID 2728 wrote to memory of 2748 2728 cmd.exe 32 PID 2728 wrote to memory of 2748 2728 cmd.exe 32 PID 2728 wrote to memory of 2748 2728 cmd.exe 32 PID 2728 wrote to memory of 2848 2728 cmd.exe 34 PID 2728 wrote to memory of 2848 2728 cmd.exe 34 PID 2728 wrote to memory of 2848 2728 cmd.exe 34 PID 2728 wrote to memory of 2848 2728 cmd.exe 34 PID 2728 wrote to memory of 2648 2728 cmd.exe 35 PID 2728 wrote to memory of 2648 2728 cmd.exe 35 PID 2728 wrote to memory of 2648 2728 cmd.exe 35 PID 2728 wrote to memory of 2648 2728 cmd.exe 35 PID 2728 wrote to memory of 2792 2728 cmd.exe 36 PID 2728 wrote to memory of 2792 2728 cmd.exe 36 PID 2728 wrote to memory of 2792 2728 cmd.exe 36 PID 2728 wrote to memory of 2792 2728 cmd.exe 36 PID 2728 wrote to memory of 2672 2728 cmd.exe 37 PID 2728 wrote to memory of 2672 2728 cmd.exe 37 PID 2728 wrote to memory of 2672 2728 cmd.exe 37 PID 2728 wrote to memory of 2672 2728 cmd.exe 37 PID 2728 wrote to memory of 2640 2728 cmd.exe 38 PID 2728 wrote to memory of 2640 2728 cmd.exe 38 PID 2728 wrote to memory of 2640 2728 cmd.exe 38 PID 2728 wrote to memory of 2640 2728 cmd.exe 38 PID 2728 wrote to memory of 2696 2728 cmd.exe 39 PID 2728 wrote to memory of 2696 2728 cmd.exe 39 PID 2728 wrote to memory of 2696 2728 cmd.exe 39 PID 2728 wrote to memory of 2696 2728 cmd.exe 39 PID 2728 wrote to memory of 2168 2728 cmd.exe 40 PID 2728 wrote to memory of 2168 2728 cmd.exe 40 PID 2728 wrote to memory of 2168 2728 cmd.exe 40 PID 2728 wrote to memory of 2168 2728 cmd.exe 40 PID 2696 wrote to memory of 2948 2696 Memo.pif 41 PID 2696 wrote to memory of 2948 2696 Memo.pif 41 PID 2696 wrote to memory of 2948 2696 Memo.pif 41 PID 2696 wrote to memory of 2948 2696 Memo.pif 41 PID 2696 wrote to memory of 2492 2696 Memo.pif 43 PID 2696 wrote to memory of 2492 2696 Memo.pif 43 PID 2696 wrote to memory of 2492 2696 Memo.pif 43 PID 2696 wrote to memory of 2492 2696 Memo.pif 43 PID 2492 wrote to memory of 2804 2492 cmd.exe 45 PID 2492 wrote to memory of 2804 2492 cmd.exe 45 PID 2492 wrote to memory of 2804 2492 cmd.exe 45 PID 2492 wrote to memory of 2804 2492 cmd.exe 45 PID 2696 wrote to memory of 3028 2696 Memo.pif 46 PID 2696 wrote to memory of 3028 2696 Memo.pif 46 PID 2696 wrote to memory of 3028 2696 Memo.pif 46 PID 2696 wrote to memory of 3028 2696 Memo.pif 46 PID 3028 wrote to memory of 2560 3028 cmd.exe 48 PID 3028 wrote to memory of 2560 3028 cmd.exe 48 PID 3028 wrote to memory of 2560 3028 cmd.exe 48 PID 3028 wrote to memory of 2560 3028 cmd.exe 48 PID 2696 wrote to memory of 524 2696 Memo.pif 50 PID 2696 wrote to memory of 524 2696 Memo.pif 50 PID 2696 wrote to memory of 524 2696 Memo.pif 50 PID 2696 wrote to memory of 524 2696 Memo.pif 50
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe"C:\Users\Admin\AppData\Local\Temp\9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Azerbaijan Azerbaijan.bat & Azerbaijan.bat & exit3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"4⤵PID:2748
-
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"4⤵PID:2648
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 229134⤵PID:2792
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Ap + Friend + County + Laws + Plant 22913\Memo.pif4⤵PID:2672
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Bring 22913\g4⤵PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\22913\Memo.pif22913\Memo.pif 22913\g4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /value5⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /value6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe5⤵PID:524
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe5⤵PID:692
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe5⤵PID:3008
-
-
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost4⤵
- Runs ping.exe
PID:2168
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url" & echo URL="C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url" & exit2⤵
- Drops startup file
PID:2948
-
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Hotmail" /tr "wscript 'C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js'" /sc minute /mo 3 /F2⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Hotmail" /tr "wscript 'C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js'" /sc minute /mo 3 /F3⤵
- Creates scheduled task(s)
PID:2804
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ap
- Size 259KB
- SHA256 61e6fb53b7c6b26fdfbee29d63bb36c8dd33ed7fb8ed97ca488d107fbc1ba3c3
- MD5 a745de26cccd7229f9b3083e0e657c51
- SHA1 ee6792f27d4d5e07f0d41dbd95b0fec772a94abf
- SHA512 9f1701d197b8e0fb1cd929404bfd9440c7ba5c724493a9a4831d9a885d1b6b169b67f344e73facefe18a753ebe22d78c61ea551a4820b7fb471d4b6670d9cc00
- SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mqd12lq+:LO0z8e0lvSr0Wyw20K4mqClq+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Azerbaijan
- Size 10KB
- SHA256 75978ba45715cad18f1dc9acc0eec4a1e6194cda6cfcb44daaeb851be665f52e
- MD5 44c71397920468dddf7bb1dc8933259f
- SHA1 fdf205c1c85f3b59dc4cf66523172fa3f37efce8
- SHA512 bf8b7e54ae65e4691a7981d6af792797be90bd55554f3f3d9316d0993e421a426046ced50cc91eac0bedaadbc315326201da640190192c1d6ff2d50a3c32369a
- SSDEEP 192:xIWA0T5pN0X2qf1WuVuP/oNCjBjrA+zYEnld7E1WHqmVZAWET8hDnRmqOOzE1fLT:1A2LN0mqtWuVEz9jrA+Rld7E14q4SWEP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bring
- Size 878KB
- SHA256 cd82e9442c7643b70b267a68f2bbe271298e7474b8310cd50e4b6e586b7d9f44
- MD5 b833ca1c2478a60371622ef394d6867d
- SHA1 4278d7af0744ed090c541563cbc2792988d00cd6
- SHA512 973dac96f9ecdf43b2bee02ffbc06583375c3fa6d2abe3541e8bb3697a6bee49f824954abb37b3385ddaf2c3447d8cea83e063349a8d5971ae0908f5430cfb0a
- SSDEEP 12288:1sUK4IFBTy3J4Ywo6a+fgca4FBKwB2HrE1srsZV:uVTYJnofgca4cEers3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\County
- Size 206KB
- SHA256 70c40c9ca3ccfe1176875a073e911e8deb3e015b6ef2fd0051223a335dd76033
- MD5 23bfb44f90ecf7e147b21aeb638be0e8
- SHA1 0764403645568683a776ef34bf4eb7c7f8775e6e
- SHA512 d8e8caccff81bee0f30b2c12c40a976b9d1df94c50208647959bce2ea3dd4a2989ba4bec0918a0ff8a9456f5dad217acfb03b46f3c97eebb7139ff9760e29278
- SSDEEP 6144:mGfm608DsvqJX4xNAB+xHFq9O0lHPOGUWLhxjRYmFqZi:mKmNvqJWNAB+X0lHPOGNnlMZi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Friend
- Size 156KB
- SHA256 f70978891348d7b742c8012d05be109c5d93e05207dd0ac4d16484e496973552
- MD5 8a0bdcea077716b3eefce44a2de444ab
- SHA1 3724020a71d0f9cc13e5f7bd4d079c92fdb01bed
- SHA512 5ea039830291f78baabc13e00cae55532cf4aa77aca03955fb080e7da1b79f55334b22198238e85f090c3f76898cacf3a476704acd53672181d349d7a624cca7
- SSDEEP 3072:eEAehuqCkrwzW3Nzl8F5hPLaLWysRIO7vHZnBfzHl8Dz5YaZYvlfAT:eEAehuqN8zwNzlmhPL1b5nZ2tZ6lfAT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Laws
- Size 284KB
- SHA256 c522ac485cfbdb75bb3f35bfe62263fb17cb64464e111d2e287b9084a85ff670
- MD5 cadb4ef1a35122c6bff9f2e1774ebbe9
- SHA1 b711c1429a69a8922da301606b2e19648a0fe537
- SHA512 6000f5511240431a9e320c5e2351a8518642786fe1aa0a59a5d523eb7899b88bf6e3ab5629d6cbf34866974b41511fdc55a83923c56da0caa92f20f360641f7e
- SSDEEP 3072:Y5A3q5eAg0Fuz08XvBNbIaAtbPf6jKj+wsxjgarB3RZgDWy4ZNogXJ3g:+EAOz04pmdV364EgarxUaBZ2mw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Plant
- Size 19KB
- SHA256 7d270a6900ef6385133b30e462bd157aa925543abaaf248cffe263fae0c33f4b
- MD5 29d98b6cbc770d518dfbf5fd2f4fa178
- SHA1 1d030e6fd228895d071c28f8e5f70676646f3734
- SHA512 8e3e890523a31c0ab4ac80400215fdd860dacedd45baf25e02a61b3f52b7fad8424c632ce2996f6f0a6e69f8a29db838febdab7636e7204b50790ae0adf0e0f6
- SSDEEP 384:VR0Xvwp52UW1l/hw50gFQTVaeCV1VEVFJ8ZcGwGBk7/UMQ3K6:SE2UWb/hMjFQTVat3VEV3GPkjI
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\7ZipSfx.000\22913\Memo.pif
- Size 924KB
- SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
- MD5 848164d084384c49937f99d5b894253e
- SHA1 3055ef803eeec4f175ebf120f94125717ee12444
- SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
- SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
- MD5 SHA1 SHA512 SSDEEP