Overview
overview
10Static
static
76fb4001217...45.exe
windows7-x64
106fb4001217...45.exe
windows10-2004-x64
10$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$TEMP/BroomSetup.exe
windows7-x64
7$TEMP/BroomSetup.exe
windows10-2004-x64
7$TEMP/syncUpd.exe
windows7-x64
10$TEMP/syncUpd.exe
windows10-2004-x64
10Analysis
-
max time kernel
157s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 16:47
Behavioral task
behavioral1
Sample
6fb4001217e696e9a91794e18b1beecfc8daede1871d8a61808652ce381a9645.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6fb4001217e696e9a91794e18b1beecfc8daede1871d8a61808652ce381a9645.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/BroomSetup.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$TEMP/BroomSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/syncUpd.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/syncUpd.exe
Resource
win10v2004-20240226-en
General
-
Target
$TEMP/BroomSetup.exe
-
Size
1.7MB
-
MD5
eee5ddcffbed16222cac0a1b4e2e466e
-
SHA1
28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
-
SHA256
2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
-
SHA512
8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
-
SSDEEP
49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
Malware Config
Signatures
-
resource yara_rule behavioral6/memory/3268-0-0x0000000000400000-0x0000000000930000-memory.dmp upx behavioral6/memory/3268-5-0x0000000000400000-0x0000000000930000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 688 schtasks.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3268 BroomSetup.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3268 wrote to memory of 3488 3268 BroomSetup.exe 91 PID 3268 wrote to memory of 3488 3268 BroomSetup.exe 91 PID 3268 wrote to memory of 3488 3268 BroomSetup.exe 91 PID 3488 wrote to memory of 3600 3488 cmd.exe 93 PID 3488 wrote to memory of 3600 3488 cmd.exe 93 PID 3488 wrote to memory of 3600 3488 cmd.exe 93 PID 3488 wrote to memory of 688 3488 cmd.exe 94 PID 3488 wrote to memory of 688 3488 cmd.exe 94 PID 3488 wrote to memory of 688 3488 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\BroomSetup.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\BroomSetup.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:3600
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\$TEMP\Updater.exe'" /sc minute /mo 30 /F3⤵
- Creates scheduled task(s)
PID:688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134B
MD5fe4c7277dd275839d983fe9e120c320d
SHA1c42dc104bb9b4a6ed80af7ce99762954116305d7
SHA256fe6f6d8f8785486a597976f1cc9587618d3ebda7814548182bd41233d8cd31e7
SHA51229fdb916f5f8a10a53f9bf3c6dfb6bdf73564b9e0a17a52e3c1a9b0457390d259bb0152bc40b7e7fadfa733d282f9c14e00f499a5bcbfe82c2b37eb90de861bf