Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/03/2024, 21:27
Behavioral task
behavioral1
Sample
7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe
Resource
win7-20240221-en
General
-
Target
7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe
-
Size
125KB
-
MD5
6722222e3dc78a102eafdf8d2f9fb340
-
SHA1
e14fe7b40686cb36c0b54e65a477b81a56410420
-
SHA256
7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d
-
SHA512
45501b8f23e300f5ada301f7968c1bd234f4f056503beed4978d3ff17beee42e930bf50de9b5518e3f4e72fed1d586ad59c28532a3994d905924926613f84f67
-
SSDEEP
1536:Ko6JdvxttIBcXISDPV2Mhg3GkFceersWjcd06UsfqW2vxq6UU/HpX:iHC6D92O8n7eU06UsfUpqCx
Malware Config
Extracted
urelas
112.175.88.209
112.175.88.207
112.175.88.208
Signatures
-
Deletes itself 1 IoCs
pid Process 2532 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2624 biudfw.exe -
Loads dropped DLL 1 IoCs
pid Process 1956 7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2624 1956 7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe 28 PID 1956 wrote to memory of 2624 1956 7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe 28 PID 1956 wrote to memory of 2624 1956 7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe 28 PID 1956 wrote to memory of 2624 1956 7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe 28 PID 1956 wrote to memory of 2532 1956 7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe 29 PID 1956 wrote to memory of 2532 1956 7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe 29 PID 1956 wrote to memory of 2532 1956 7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe 29 PID 1956 wrote to memory of 2532 1956 7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe"C:\Users\Admin\AppData\Local\Temp\7c3a4e5e2e70335a50398b338d845e0801b6977bc835bd80a6e7eddd5380a18d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
PID:2624
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
125KB
MD5fdbefa0c1e752d50214d4c836107e114
SHA1432deef8edfca72a89d2c77cc2fcbb649db6ebb8
SHA25661d2a491d28d4cff00de84e52578ffd45047d18e5cd0b3da1f1b7a3f70d4be47
SHA5129956007e15aa408f2971274cbc21c70e88091cc1176bfa35adc06b9cd0fcf193dfdda659b1729913056a6e0230440a79f44a20230036869430c7210e09b7e677
-
Filesize
512B
MD5d8b6fb23d659bed3f6b1cf40a104e95a
SHA107c9c74af6b0fe9b78bb1b3aed5bdc1e0b5de952
SHA256f28d96334bf66f634f899c800b4d5c6195bcf407cb073761f8a4f30a4061f136
SHA512e841cd9283c63a92395b4221492e2ae6b06d9c4108fcbbfe7d8a7928cfca405c14c0634a6388a4f18da3db611696ea797f9b825ed314d1640a17aa767593e412
-
Filesize
338B
MD5d0eca34489c003255da2ab93c491e6ee
SHA1a72bb0bf2f8b425f905b8357545b22db3e42821b
SHA256a389de244b8ffcd8dcad2dc138e688439d682c61c5114ce5ef3d31f28145cedb
SHA512a5b826a94bfae596d138a8fead4aadfa0ea7ac029e643c700485a16d014222862049efba8b9e1a4bb6a1694cab6a0c743e9b959763dd8a9d91b6bb7ae36fe670
-
Filesize
105KB
MD521547521a6fd3879a82439960675de00
SHA1b1d9197b022d8f214c69953ee8f0c1801994a563
SHA256e7edd3eae7e3566670fa409808132264c3bb0f07d087acabe0cedf371af8b2b5
SHA51271340bb609679abf1c1cd69dd786ed295a7d20d860a1da18912c3df796cc8bcd10cfd00930298f6f0c2358fa47c5c49e0623bed2e9f2eaad1b71d9a282fda2de