4baa9c00d3f102e23ef38feb93ae7825417fdfeb6cd6a2a76d0d93338c8ea638

Analysis

max time kernel
153s
max time network
157s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7bbd390b88e13261579c9c8aa8ab97e.exe
Size

49KB
MD5

e7bbd390b88e13261579c9c8aa8ab97e
SHA1

d57514321c3548e573e5b5dc2b832cee186bec4a
SHA256

4baa9c00d3f102e23ef38feb93ae7825417fdfeb6cd6a2a76d0d93338c8ea638
SHA512

9b8b00a1c8455d5db1a93f1cbd6ceebba54a6e5be7a1d82c7d9f347293cc9df36d636e7d6315c17ad14f90b6a2db87cc97df585a4a77f66f3e3b9d6e92af4df2
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1xzpAIV:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7y

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2796	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
2748	e7bbd390b88e13261579c9c8aa8ab97e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2748	e7bbd390b88e13261579c9c8aa8ab97e.exe
2796	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2796	2748	e7bbd390b88e13261579c9c8aa8ab97e.exe	28
PID 2748 wrote to memory of 2796	2748	e7bbd390b88e13261579c9c8aa8ab97e.exe	28
PID 2748 wrote to memory of 2796	2748	e7bbd390b88e13261579c9c8aa8ab97e.exe	28
PID 2748 wrote to memory of 2796	2748	e7bbd390b88e13261579c9c8aa8ab97e.exe	28

C:\Users\Admin\AppData\Local\Temp\e7bbd390b88e13261579c9c8aa8ab97e.exe
"C:\Users\Admin\AppData\Local\Temp\e7bbd390b88e13261579c9c8aa8ab97e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
49KB

MD5
a4bb2362e1bb43bfb8e87b0cc4655239

SHA1
7b4ad22cedc1975a8884e719c199eb4ca5197dc8

SHA256
8597eb484750eb0f00b9eeaeabbd60b378027f3a03ff82c8595409ca1ef21409

SHA512
40a1086719158423ffed8ea1377e55db80a4a68b2f00588a7fd4c76c64098927a2b029e6f842b0ad7292a9bf06cab4fbacc3743daeefee9826d6a661ec88bfe0

Download Submit
memory/2748-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2748-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2748-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2796-17-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download