5ea84f8f933017eb51519e628002909ba5dcf81a34830147ff2368a9d430496d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Thunder.exe
Size

2.0MB
MD5

16f50a44d7ff076f87806f5a6710bc13
SHA1

8af1513250078aa085c8cedc3f4d49a833b7d74c
SHA256

a596f3bcf6c8b26a5c407c2c234546f1b0808126037426869865d61b8868f1de
SHA512

36950a4fdc591dcc44fb6a416039b413d96678e52bf3e5e455bcc47742254bb11060689a319304c53396ddef9573e1848446d2c7926799fde5fbebb247cce286
SSDEEP

49152:69UGevOS9BDQMi+Zh3KUFhzhnwx10DOnm52SA6KZHgofvnH:69zeWS9BDQQFhmyOnm5dIgoHH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2764	ThunderFW.exe

Loads dropped DLL 4 IoCs

pid	Process
1736	Thunder.exe
1736	Thunder.exe
1736	Thunder.exe
1736	Thunder.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\atl71.dll	Thunder.exe
File created	C:\Windows\SysWOW64\msvcp71.dll	Thunder.exe
File created	C:\Windows\SysWOW64\msvcr71.dll	Thunder.exe
File created	C:\Windows\SysWOW64\libpng13.dll	Thunder.exe
File created	C:\Windows\SysWOW64\zlib1.dll	Thunder.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2764	1736	Thunder.exe	28
PID 1736 wrote to memory of 2764	1736	Thunder.exe	28
PID 1736 wrote to memory of 2764	1736	Thunder.exe	28
PID 1736 wrote to memory of 2764	1736	Thunder.exe	28

C:\Users\Admin\AppData\Local\Temp\Thunder.exe
"C:\Users\Admin\AppData\Local\Temp\Thunder.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\MiniXL\bin\ThunderFW.exe
  "C:\Users\Admin\AppData\Local\Temp\MiniXL\bin\ThunderFW.exe" ThunderMini1.0.1.86 "C:\Users\Admin\AppData\Local\Temp\MiniXL\bin\ThunderMini.exe"
  2⤵
  - Executes dropped EXE
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\MiniXL\Bin\ThunderFW.exe

Filesize
67KB

MD5
5db78d4e1a2139e566b608d33396ffb3

SHA1
c52fbece711b5a819802983a1a4f3b44f135dab0

SHA256
b378b9c3bfc3fdb32df381d339112cb4244e05ed7dc9e26cb82943e0f758ab42

SHA512
db685c5acabec782f9dff6452b9a6d09942fdd26ff2632623d7968a9f595ffcd22241ffd9e49505da47a45302cfc9de6cb70ada005ec209f44317fe093dbad05

Download Submit
\Users\Admin\AppData\Local\Temp\MiniXL\Bin\ThunderMini.exe

Filesize
516KB

MD5
7491faba754bdc680c46b9341f4548b3

SHA1
f6542a0ae599eca454e1ab3c697d72a75a15656c

SHA256
d36ba16f2bc9b3951e73ed4fa5bd906e5565bf8ab26543b99502a3a01e2fe353

SHA512
7486a2667475e2e6294c0bd31ec892ffbd6ff89f226bbdfdacdc9cdd6e74377b85ed7d5e7bea640216cbcc1ef96e5d8e7e3b2698547fd43de48cf5a4c26c7908

Download Submit
\Users\Admin\AppData\Local\Temp\nsy57E2.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit