Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 10:45
Behavioral task
behavioral1
Sample
c5ad35303d1ffad33cc1e0149b9944df.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c5ad35303d1ffad33cc1e0149b9944df.exe
Resource
win10v2004-20240226-en
General
-
Target
c5ad35303d1ffad33cc1e0149b9944df.exe
-
Size
45KB
-
MD5
c5ad35303d1ffad33cc1e0149b9944df
-
SHA1
fc4a3308f089804f24adaa0852ab57ac8e2b13d4
-
SHA256
44310c7190866c75e9e1b11adf2e5024ea48c90230b6737e5aca7d6667600f57
-
SHA512
457a82a5f8d9f065cf819901bdcdeae90d5cec8ec6d191c9b4b717f7417b937c17d5c66ca62125a8284d857420182a66bf1b101ea454cd62aafd0eac6435bea3
-
SSDEEP
768:QLQYBHWBRmiYlg+RA+sT4+AxHelme8IdezhYvl62MzXO40jc07wNR:vYloR5l+RXshGHel8+vDMb10c
Malware Config
Signatures
-
Executes dropped EXE 10 IoCs
pid Process 2752 SPLOPE.exe 2448 SPLOPE.exe 1508 SPLOPE.exe 940 SPLOPE.exe 2336 SPLOPE.exe 2212 SPLOPE.exe 1904 SPLOPE.exe 1548 SPLOPE.exe 2960 SPLOPE.exe 2808 SPLOPE.exe -
Loads dropped DLL 3 IoCs
pid Process 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 2752 SPLOPE.exe -
resource yara_rule behavioral1/memory/2460-0-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/files/0x0024000000015c3c-3.dat upx behavioral1/memory/2752-11-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2460-14-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2448-18-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2752-21-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/1508-23-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2448-26-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/940-28-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/1508-31-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2336-33-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/940-36-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2336-40-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/1904-42-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2212-45-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/1548-47-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/1904-50-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/1548-54-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2808-56-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2960-59-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral1/memory/2808-60-0x0000000000400000-0x0000000000424000-memory.dmp upx -
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" c5ad35303d1ffad33cc1e0149b9944df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Mrxiaokan7 = "C:\\Program Files\\Internet Explorer\\SPLOPE.exe" SPLOPE.exe -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\SPLOPE.exe c5ad35303d1ffad33cc1e0149b9944df.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.dat c5ad35303d1ffad33cc1e0149b9944df.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe c5ad35303d1ffad33cc1e0149b9944df.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File opened for modification C:\Program Files\Internet Explorer\SPLOPE.dat SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe File created C:\Program Files\Internet Explorer\SPLOPE.exe SPLOPE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2736 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 28 PID 2460 wrote to memory of 2736 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 28 PID 2460 wrote to memory of 2736 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 28 PID 2460 wrote to memory of 2736 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 28 PID 2736 wrote to memory of 2524 2736 net.exe 30 PID 2736 wrote to memory of 2524 2736 net.exe 30 PID 2736 wrote to memory of 2524 2736 net.exe 30 PID 2736 wrote to memory of 2524 2736 net.exe 30 PID 2460 wrote to memory of 2752 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 31 PID 2460 wrote to memory of 2752 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 31 PID 2460 wrote to memory of 2752 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 31 PID 2460 wrote to memory of 2752 2460 c5ad35303d1ffad33cc1e0149b9944df.exe 31 PID 2752 wrote to memory of 2608 2752 SPLOPE.exe 32 PID 2752 wrote to memory of 2608 2752 SPLOPE.exe 32 PID 2752 wrote to memory of 2608 2752 SPLOPE.exe 32 PID 2752 wrote to memory of 2608 2752 SPLOPE.exe 32 PID 2608 wrote to memory of 2540 2608 net.exe 34 PID 2608 wrote to memory of 2540 2608 net.exe 34 PID 2608 wrote to memory of 2540 2608 net.exe 34 PID 2608 wrote to memory of 2540 2608 net.exe 34 PID 2752 wrote to memory of 2448 2752 SPLOPE.exe 35 PID 2752 wrote to memory of 2448 2752 SPLOPE.exe 35 PID 2752 wrote to memory of 2448 2752 SPLOPE.exe 35 PID 2752 wrote to memory of 2448 2752 SPLOPE.exe 35 PID 2448 wrote to memory of 2416 2448 SPLOPE.exe 36 PID 2448 wrote to memory of 2416 2448 SPLOPE.exe 36 PID 2448 wrote to memory of 2416 2448 SPLOPE.exe 36 PID 2448 wrote to memory of 2416 2448 SPLOPE.exe 36 PID 2416 wrote to memory of 2160 2416 net.exe 38 PID 2416 wrote to memory of 2160 2416 net.exe 38 PID 2416 wrote to memory of 2160 2416 net.exe 38 PID 2416 wrote to memory of 2160 2416 net.exe 38 PID 2448 wrote to memory of 1508 2448 SPLOPE.exe 39 PID 2448 wrote to memory of 1508 2448 SPLOPE.exe 39 PID 2448 wrote to memory of 1508 2448 SPLOPE.exe 39 PID 2448 wrote to memory of 1508 2448 SPLOPE.exe 39 PID 1508 wrote to memory of 856 1508 SPLOPE.exe 40 PID 1508 wrote to memory of 856 1508 SPLOPE.exe 40 PID 1508 wrote to memory of 856 1508 SPLOPE.exe 40 PID 1508 wrote to memory of 856 1508 SPLOPE.exe 40 PID 856 wrote to memory of 1760 856 net.exe 42 PID 856 wrote to memory of 1760 856 net.exe 42 PID 856 wrote to memory of 1760 856 net.exe 42 PID 856 wrote to memory of 1760 856 net.exe 42 PID 1508 wrote to memory of 940 1508 SPLOPE.exe 43 PID 1508 wrote to memory of 940 1508 SPLOPE.exe 43 PID 1508 wrote to memory of 940 1508 SPLOPE.exe 43 PID 1508 wrote to memory of 940 1508 SPLOPE.exe 43 PID 940 wrote to memory of 2280 940 SPLOPE.exe 44 PID 940 wrote to memory of 2280 940 SPLOPE.exe 44 PID 940 wrote to memory of 2280 940 SPLOPE.exe 44 PID 940 wrote to memory of 2280 940 SPLOPE.exe 44 PID 2280 wrote to memory of 2620 2280 net.exe 46 PID 2280 wrote to memory of 2620 2280 net.exe 46 PID 2280 wrote to memory of 2620 2280 net.exe 46 PID 2280 wrote to memory of 2620 2280 net.exe 46 PID 940 wrote to memory of 2336 940 SPLOPE.exe 47 PID 940 wrote to memory of 2336 940 SPLOPE.exe 47 PID 940 wrote to memory of 2336 940 SPLOPE.exe 47 PID 940 wrote to memory of 2336 940 SPLOPE.exe 47 PID 2336 wrote to memory of 2644 2336 SPLOPE.exe 48 PID 2336 wrote to memory of 2644 2336 SPLOPE.exe 48 PID 2336 wrote to memory of 2644 2336 SPLOPE.exe 48 PID 2336 wrote to memory of 2644 2336 SPLOPE.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5ad35303d1ffad33cc1e0149b9944df.exe"C:\Users\Admin\AppData\Local\Temp\c5ad35303d1ffad33cc1e0149b9944df.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess3⤵PID:2524
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵PID:2540
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess4⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess5⤵PID:2160
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess5⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess6⤵PID:1760
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess6⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess7⤵PID:2620
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess7⤵PID:2644
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess8⤵PID:2568
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2212 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess8⤵PID:816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess9⤵PID:1924
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1904 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess9⤵PID:2992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess10⤵PID:1584
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1548 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess10⤵PID:2044
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess11⤵PID:616
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2960 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess11⤵PID:2020
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess12⤵PID:2156
-
-
-
C:\Program Files\Internet Explorer\SPLOPE.exe"C:\Program Files\Internet Explorer\SPLOPE.exe"11⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2808 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess12⤵PID:2060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess13⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
426B
MD599cdac74312ddd8fcf0720e4461893c7
SHA16bb768c9fb2b261b422c7ca1b20aa48ed35b8e52
SHA2565c7867163b33836c71c9957b0b6a70c7c3d9d9521288841a5ecbd9e649e592c6
SHA51290093584433e4e1c64c34c9d143eaf1f852f78490cb7acca4df6a64a8acf507d5895cfd361ed0d596ef746f83b382fc7c8a0c3a716d753b043defc306af1c9ef
-
Filesize
45KB
MD5c5ad35303d1ffad33cc1e0149b9944df
SHA1fc4a3308f089804f24adaa0852ab57ac8e2b13d4
SHA25644310c7190866c75e9e1b11adf2e5024ea48c90230b6737e5aca7d6667600f57
SHA512457a82a5f8d9f065cf819901bdcdeae90d5cec8ec6d191c9b4b717f7417b937c17d5c66ca62125a8284d857420182a66bf1b101ea454cd62aafd0eac6435bea3