Overview
overview
10Static
static
7309ec6307a...17.exe
windows7-x64
7309ec6307a...17.exe
windows10-2004-x64
10$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$TEMP/BroomSetup.exe
windows7-x64
7$TEMP/BroomSetup.exe
windows10-2004-x64
7$TEMP/syncUpd.exe
windows7-x64
10$TEMP/syncUpd.exe
windows10-2004-x64
10Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 12:22
Behavioral task
behavioral1
Sample
309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/BroomSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMP/BroomSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/syncUpd.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$TEMP/syncUpd.exe
Resource
win10v2004-20240226-en
General
-
Target
309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe
-
Size
2.0MB
-
MD5
23f626717d84253e95c463a266a28a4e
-
SHA1
f1e2ab8fb2f12eae52028ba491a672c79770e052
-
SHA256
309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417
-
SHA512
90551396fdd81876b9a4caf1ee5ea38667dfdd99fba58ebbe4e04dbdc183ecbce281c594117e2ad13abf198a286087db393b1df45e0e4ab52c73a25b30a0fca6
-
SSDEEP
49152:L71kcjGwZPU046Gaut8sCstaHQB6Nvq2TbLJ5R:lkVSx1GPhSQBal/vR
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1900 syncUpd.exe 2648 BroomSetup.exe -
Loads dropped DLL 5 IoCs
pid Process 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe -
resource yara_rule behavioral1/files/0x0006000000015cb6-21.dat upx behavioral1/files/0x0006000000015cb6-29.dat upx behavioral1/memory/2648-31-0x0000000000400000-0x0000000000930000-memory.dmp upx behavioral1/memory/2648-41-0x0000000000400000-0x0000000000930000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2620 schtasks.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2648 BroomSetup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 824 wrote to memory of 1900 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 28 PID 824 wrote to memory of 1900 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 28 PID 824 wrote to memory of 1900 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 28 PID 824 wrote to memory of 1900 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 28 PID 824 wrote to memory of 2648 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 29 PID 824 wrote to memory of 2648 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 29 PID 824 wrote to memory of 2648 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 29 PID 824 wrote to memory of 2648 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 29 PID 824 wrote to memory of 2648 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 29 PID 824 wrote to memory of 2648 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 29 PID 824 wrote to memory of 2648 824 309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe 29 PID 2648 wrote to memory of 2044 2648 BroomSetup.exe 30 PID 2648 wrote to memory of 2044 2648 BroomSetup.exe 30 PID 2648 wrote to memory of 2044 2648 BroomSetup.exe 30 PID 2648 wrote to memory of 2044 2648 BroomSetup.exe 30 PID 2044 wrote to memory of 2492 2044 cmd.exe 32 PID 2044 wrote to memory of 2492 2044 cmd.exe 32 PID 2044 wrote to memory of 2492 2044 cmd.exe 32 PID 2044 wrote to memory of 2492 2044 cmd.exe 32 PID 2044 wrote to memory of 2620 2044 cmd.exe 33 PID 2044 wrote to memory of 2620 2044 cmd.exe 33 PID 2044 wrote to memory of 2620 2044 cmd.exe 33 PID 2044 wrote to memory of 2620 2044 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe"C:\Users\Admin\AppData\Local\Temp\309ec6307a21fa5259fc2e1b517b03b1fe9b37fe68fef49107cb82a35b5c6417.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\syncUpd.exeC:\Users\Admin\AppData\Local\Temp\syncUpd.exe2⤵
- Executes dropped EXE
PID:1900
-
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:2492
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F4⤵
- Creates scheduled task(s)
PID:2620
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5eee5ddcffbed16222cac0a1b4e2e466e
SHA128b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
SHA2562a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
SHA5128f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
-
Filesize
128B
MD511bb3db51f701d4e42d3287f71a6a43e
SHA163a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA2566be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
-
Filesize
896KB
MD5a5681665ddd8951fd1864b1713257566
SHA167b2306e62e06516e525ab004ba12eaf2d069446
SHA2562ed6dda3f4c65cabff319975bc4d4124677a89fb71cb5fdc0c36af5d196abea6
SHA51299ef06862b0be0b83ba8cddea22ab36977d809cbc295004c2ca3315ad731fc5b8bc2f7952cdc8f9b52d59bf53fb18cdde6e7f373859be1672235989f46256aa0
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
199KB
MD504cdeae76554c91315c3524135267d7c
SHA14e4bc1eb29a0d745b65c87d64bf80e5a8461b7f8
SHA25662a4dd1892de69284a7ae05b81b79da497e3840ceb4e8f4f0fd8fc83d4d643b6
SHA5126d645cdc6335a1df3863ec99f10beb977a8cc177316d26eddce34936ea1428f3b7d82ea2d44d0c36923538b32ce3444220b0b0088383dec279a9c91fbd34376a