Overview
overview
10Static
static
10malware-sa...04.exe
windows7-x64
10malware-sa...04.exe
windows10-2004-x64
10malware-sa...nt.doc
windows7-x64
4malware-sa...nt.doc
windows10-2004-x64
1malware-sa...oc.xls
windows7-x64
10malware-sa...oc.xls
windows10-2004-x64
10malware-sa...l.docm
windows7-x64
10malware-sa...l.docm
windows10-2004-x64
10malware-sa...nt.exe
windows7-x64
3malware-sa...nt.exe
windows10-2004-x64
3malware-sa...on.exe
windows7-x64
1malware-sa...on.exe
windows10-2004-x64
3malware-sa...el.exe
windows7-x64
1malware-sa...el.exe
windows10-2004-x64
1malware-sa...ab.exe
windows7-x64
1malware-sa...ab.exe
windows10-2004-x64
1malware-sa...nt.exe
windows7-x64
1malware-sa...nt.exe
windows10-2004-x64
1malware-sa...nt.exe
windows7-x64
1malware-sa...nt.exe
windows10-2004-x64
1malware-sa...FI.exe
windows7-x64
8malware-sa...FI.exe
windows10-2004-x64
8malware-sa...nt.exe
windows7-x64
7malware-sa...nt.exe
windows10-2004-x64
7malware-sa...LL.dll
windows7-x64
1malware-sa...LL.dll
windows10-2004-x64
1malware-sa...ar.bin
macos-10.15-amd64
1malware-sa...an.exe
windows7-x64
1malware-sa...an.exe
windows10-2004-x64
1malware-sa...64.dll
windows7-x64
8malware-sa...64.dll
windows10-2004-x64
8malware-sa...28.exe
windows7-x64
7Analysis
-
max time kernel
149s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 02:15
Static task
static1
Behavioral task
behavioral1
Sample
malware-sample-library-master/APT28 FancyBear/APT28,NATOPAPER,SOFACY2004.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
malware-sample-library-master/APT28 FancyBear/APT28,NATOPAPER,SOFACY2004.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
malware-sample-library-master/APT28 FancyBear/APT28DecoyDocument.doc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
malware-sample-library-master/APT28 FancyBear/APT28DecoyDocument.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
malware-sample-library-master/APT28 FancyBear/APT28DropperExcelDoc.xls
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
malware-sample-library-master/APT28 FancyBear/APT28Hospital.docm
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
malware-sample-library-master/APT28 FancyBear/APT28Hospital.docm
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
malware-sample-library-master/APT28 FancyBear/APT28Implant.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
malware-sample-library-master/APT28 FancyBear/APT28Implant.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
malware-sample-library-master/APT28 FancyBear/APT28wmsApplication.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
malware-sample-library-master/APT28 FancyBear/APT28wmsApplication.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
malware-sample-library-master/APT28 FancyBear/Backdoor.XTunnel.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
malware-sample-library-master/APT28 FancyBear/Backdoor.XTunnel.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
malware-sample-library-master/APT28 FancyBear/FancyBearZekapab.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
malware-sample-library-master/APT28 FancyBear/FancyBearZekapab.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
malware-sample-library-master/APT28 FancyBear/FancyBearZekapabImplant.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
malware-sample-library-master/APT28 FancyBear/FancyBearZekapabImplant.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
malware-sample-library-master/APT28 FancyBear/FancyImplant.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
malware-sample-library-master/APT28 FancyBear/FancyImplant.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxInfo_EFI.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxInfo_EFI.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxSmallAgent.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxSmallAgent.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxSmall_AgentDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
malware-sample-library-master/APT28 FancyBear/LoJaxSmall_AgentDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
malware-sample-library-master/APT28 FancyBear/MacOSKomplexFancyBear.bin
Resource
macos-20240214-en
Behavioral task
behavioral28
Sample
malware-sample-library-master/APT28 FancyBear/X-AgentTrojan.exe
Resource
win7-20231129-en
Behavioral task
behavioral29
Sample
malware-sample-library-master/APT28 FancyBear/X-AgentTrojan.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
malware-sample-library-master/APT28 FancyBear/Xagent64.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
malware-sample-library-master/APT28 FancyBear/Xagent64.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
malware-sample-library-master/APT28 FancyBear/ZekaAPT28.exe
Resource
win7-20240221-en
General
-
Target
malware-sample-library-master/APT28 FancyBear/APT28Hospital.docm
-
Size
76KB
-
MD5
9b10685b774a783eabfecdb6119a8aa3
-
SHA1
f293a2bfb728060c54efeeb03c5323893b5c80df
-
SHA256
a4a455db9f297e2b9fe99d63c9d31e827efb2cda65be445625fa64f4fce7f797
-
SHA512
26a0f0dd37439da543526704b5a689ed9f9317baf357d9a7a4d885855d80b5745a07972da3a1c5b06f39fcbbbff9e94f0729edbdba8963b0dcb8c650addbdc48
-
SSDEEP
1536:009J0E4v13p/gL7Jj4P9bvzKGXpIiUvh23oKRO/HhcKmFoR:fb4v13pYL7J49bvr5Iias32Jc5FoR
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5044 4016 rundll32.exe -
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 46 4452 rundll32.exe 53 4452 rundll32.exe 84 4452 rundll32.exe 85 4452 rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1996 rundll32.exe 4452 rundll32.exe -
Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\mrset.bat" rundll32.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3888 WINWORD.EXE 3888 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 4452 rundll32.exe 4452 rundll32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE 3888 WINWORD.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.execmd.exedescription pid process target process PID 5044 wrote to memory of 1996 5044 rundll32.exe rundll32.exe PID 5044 wrote to memory of 1996 5044 rundll32.exe rundll32.exe PID 5044 wrote to memory of 1996 5044 rundll32.exe rundll32.exe PID 1996 wrote to memory of 4180 1996 rundll32.exe cmd.exe PID 1996 wrote to memory of 4180 1996 rundll32.exe cmd.exe PID 1996 wrote to memory of 4180 1996 rundll32.exe cmd.exe PID 4180 wrote to memory of 4452 4180 cmd.exe rundll32.exe PID 4180 wrote to memory of 4452 4180 cmd.exe rundll32.exe PID 4180 wrote to memory of 4452 4180 cmd.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\malware-sample-library-master\APT28 FancyBear\APT28Hospital.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Roaming\user.dat, #11⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Roaming\user.dat, #12⤵
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\mrset.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\mvtband.dat",#14⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lexFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\mrset.batFilesize
106B
MD5583ea25b69feded9f65cfbff169147a9
SHA156e6487b283f2718483fe8823f70e36ffbce6fb7
SHA25651eaf3b30c1ea932843cb9f5b6fb41804976d94a53a507ccb292b8392276cfd6
SHA512adeb0df1f5edf3d1348f048da8760c2f8a9b3b0a8fd87a92ec62fbf0fc83681b928c2bee064a0b731bc4842c5d34f9e00e00303c4de4a56c9027e127d30260f5
-
C:\Users\Admin\AppData\Roaming\mvtband.datFilesize
29KB
MD51421419d1be31f1f9ea60e8ed87277db
SHA1f9fd3f1d8da4ffd6a494228b934549d09e3c59d1
SHA2568c47961181d9929333628af20bdd750021e925f40065374e6b876e3b8afbba57
SHA512a6825107c5e60231dcf631e702c3b75422bad8644ac69df21aa9e9437758850f31d84fe95a4e0386235b3b7103bbcc8945365f4d804cbb16e161c5577680a072
-
C:\Users\Admin\AppData\Roaming\user.datFilesize
69KB
MD5b1d1a2c64474d2f6e7a5db71ccbafa31
SHA191d8e6f993e8b294924811df052e96cbec0545ad
SHA25658b223f74992f371cab8f1df7c03b9b66f2ea9e3c9e22122898a9be62a05c0b4
SHA5127f3a458083159e51e505074c46fa18a744bed43a21efca957a0bd60a8c8347597025dedf500b73c4cb5f5a107fb8975cb52b453deddf9fc69e46f8d417004b44
-
memory/3888-44-0x0000016B59700000-0x0000016B5A6D0000-memory.dmpFilesize
15.8MB
-
memory/3888-55-0x0000016B59700000-0x0000016B5A6D0000-memory.dmpFilesize
15.8MB
-
memory/3888-6-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-8-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmpFilesize
64KB
-
memory/3888-9-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-7-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-10-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-11-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-12-0x00007FFDC2C70000-0x00007FFDC2C80000-memory.dmpFilesize
64KB
-
memory/3888-13-0x00007FFDC2C70000-0x00007FFDC2C80000-memory.dmpFilesize
64KB
-
memory/3888-26-0x0000016B59700000-0x0000016B5A6D0000-memory.dmpFilesize
15.8MB
-
memory/3888-37-0x0000016B59700000-0x0000016B5A6D0000-memory.dmpFilesize
15.8MB
-
memory/3888-0-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmpFilesize
64KB
-
memory/3888-50-0x0000016B59700000-0x0000016B5A6D0000-memory.dmpFilesize
15.8MB
-
memory/3888-4-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-5-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmpFilesize
64KB
-
memory/3888-3-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-2-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmpFilesize
64KB
-
memory/3888-1-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmpFilesize
64KB
-
memory/3888-75-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-76-0x0000016B59700000-0x0000016B5A6D0000-memory.dmpFilesize
15.8MB
-
memory/3888-77-0x0000016B59700000-0x0000016B5A6D0000-memory.dmpFilesize
15.8MB
-
memory/3888-78-0x0000016B59700000-0x0000016B5A6D0000-memory.dmpFilesize
15.8MB
-
memory/3888-79-0x0000016B59700000-0x0000016B5A6D0000-memory.dmpFilesize
15.8MB
-
memory/3888-103-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmpFilesize
64KB
-
memory/3888-104-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmpFilesize
64KB
-
memory/3888-105-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmpFilesize
64KB
-
memory/3888-106-0x00007FFDC54B0000-0x00007FFDC54C0000-memory.dmpFilesize
64KB
-
memory/3888-107-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-108-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB
-
memory/3888-109-0x00007FFE05430000-0x00007FFE05625000-memory.dmpFilesize
2.0MB