Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
17/03/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe
Resource
win7-20231129-en
General
-
Target
f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe
-
Size
97KB
-
MD5
034e6ee05fcbc8a0e1eb4b4474715f07
-
SHA1
8ce1a9e8ad5e0c3e2f09372d4eaeb9519f095a84
-
SHA256
f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0
-
SHA512
8767a32cfec4c2a8ac51855a2f6257ff6cc9690d853961c539a6cc217e412d219ddee50678bd79e8f61d33b011534b4eca40bc8e31ab177f19dc7886eb228111
-
SSDEEP
1536:tquG5UkVx28W+OCASbUHY98wNYp37wweKcSM:MLUom+4sUHENYxwwBcF
Malware Config
Extracted
urelas
112.175.88.208
112.175.88.207
Signatures
-
Deletes itself 1 IoCs
pid Process 1344 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2972 huter.exe -
Loads dropped DLL 1 IoCs
pid Process 1964 f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2972 1964 f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe 28 PID 1964 wrote to memory of 2972 1964 f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe 28 PID 1964 wrote to memory of 2972 1964 f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe 28 PID 1964 wrote to memory of 2972 1964 f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe 28 PID 1964 wrote to memory of 1344 1964 f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe 29 PID 1964 wrote to memory of 1344 1964 f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe 29 PID 1964 wrote to memory of 1344 1964 f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe 29 PID 1964 wrote to memory of 1344 1964 f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe"C:\Users\Admin\AppData\Local\Temp\f86aef09f97fc8ce44d0eb7826a92845c74688aad8aec11d80ab6d8632b388b0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
PID:2972
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
PID:1344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5ad66dcc3e4d62e8844a34f8e570fc21d
SHA15ae300786796af39a81a5f96daddbb5fd6d7ad0a
SHA256b7b165b08c5e5fff025ada3ba0b814d0e1323567a23ecd89d7b6f264e48c74b1
SHA51224ed5e4361ac13ae419cfcabed2650eb07e646f61b3d9e4d6c67d3a3ca31d7a504c015dde6e9b859d20edf03e90698fa879c4fe1c62b26238736cd8dcf390105
-
Filesize
338B
MD5b3262c8533a67d54004ef6e527d9bb24
SHA145b6b9786078b1a8d283f9cadfebd3167180b66d
SHA2566a6f9142af4836797f9217a61eb81d67c461f87a404ef8e3be6bcc5913023b38
SHA512cdb44109ce3a23121c05d14369c9a856f3e52ac3a932b59689d361f0974348ac3388b03cc5f4008a6950d090ef8e1f90658e29486f101f39a4c0a5fa07116a30
-
Filesize
97KB
MD5cfe18579a47456ecea45bdf185f79fa1
SHA19bb2fe282c0f61f15b2dd180ba82e544780e689b
SHA256574d65b8af3759b29c233e7823707829f359f617a03e546f7710684533c09233
SHA5120b12961dd911194dbd0c36b72f0905390c1eff25702060a88501c184c5fc7f73f64ee84d71e41626f47513e75b0a8327c774b59b8de7537fd8d9153a2130f2ae