Overview
overview
10Static
static
76fb4001217...45.exe
windows7-x64
106fb4001217...45.exe
windows10-2004-x64
10$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$TEMP/BroomSetup.exe
windows7-x64
7$TEMP/BroomSetup.exe
windows10-2004-x64
7$TEMP/syncUpd.exe
windows7-x64
10$TEMP/syncUpd.exe
windows10-2004-x64
10Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 16:47
Behavioral task
behavioral1
Sample
6fb4001217e696e9a91794e18b1beecfc8daede1871d8a61808652ce381a9645.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6fb4001217e696e9a91794e18b1beecfc8daede1871d8a61808652ce381a9645.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/BroomSetup.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$TEMP/BroomSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/syncUpd.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/syncUpd.exe
Resource
win10v2004-20240226-en
General
-
Target
$TEMP/BroomSetup.exe
-
Size
1.7MB
-
MD5
eee5ddcffbed16222cac0a1b4e2e466e
-
SHA1
28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
-
SHA256
2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
-
SHA512
8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
-
SSDEEP
49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
Malware Config
Signatures
-
resource yara_rule behavioral5/memory/1888-0-0x0000000000400000-0x0000000000930000-memory.dmp upx behavioral5/memory/1888-10-0x0000000000400000-0x0000000000930000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2592 schtasks.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1888 BroomSetup.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2968 1888 BroomSetup.exe 28 PID 1888 wrote to memory of 2968 1888 BroomSetup.exe 28 PID 1888 wrote to memory of 2968 1888 BroomSetup.exe 28 PID 1888 wrote to memory of 2968 1888 BroomSetup.exe 28 PID 2968 wrote to memory of 2588 2968 cmd.exe 30 PID 2968 wrote to memory of 2588 2968 cmd.exe 30 PID 2968 wrote to memory of 2588 2968 cmd.exe 30 PID 2968 wrote to memory of 2588 2968 cmd.exe 30 PID 2968 wrote to memory of 2592 2968 cmd.exe 31 PID 2968 wrote to memory of 2592 2968 cmd.exe 31 PID 2968 wrote to memory of 2592 2968 cmd.exe 31 PID 2968 wrote to memory of 2592 2968 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\BroomSetup.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\BroomSetup.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:2588
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\$TEMP\Updater.exe'" /sc minute /mo 30 /F3⤵
- Creates scheduled task(s)
PID:2592
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134B
MD5fe4c7277dd275839d983fe9e120c320d
SHA1c42dc104bb9b4a6ed80af7ce99762954116305d7
SHA256fe6f6d8f8785486a597976f1cc9587618d3ebda7814548182bd41233d8cd31e7
SHA51229fdb916f5f8a10a53f9bf3c6dfb6bdf73564b9e0a17a52e3c1a9b0457390d259bb0152bc40b7e7fadfa733d282f9c14e00f499a5bcbfe82c2b37eb90de861bf