276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22/03/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b1ad5aa40c89bce3ed9d22762085fb2b.exe
Size 4.0MB
Sample240322-jft2baaa65
SHA256 276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf
MD5 b1ad5aa40c89bce3ed9d22762085fb2b
SHA1 c93518cff3e1554a9d9112b972bcfcdef77f6fed
SHA512 6dc10010fbe21dd1f43d5465952b2ba39882c9c1cb3c9285d531fab937d18c2e1590a5987aad46d7f0a7fe41587f2b69a10095eb46f18acdd52533c48740605f
SSDEEP 98304:sfUbEBPzHDUZsrqpj4F4i0OY1ZjBpyTvodRYVBAywLtQzG:sfUoPzHDUZsrqpkFraUTvodRGAy4AG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1840	b1ad5aa40c89bce3ed9d22762085fb2b.exe
2556	RttHlp.exe
2388	RttHlp.exe

Loads dropped DLL 12 IoCs

pid	Process
1956	b1ad5aa40c89bce3ed9d22762085fb2b.exe
1840	b1ad5aa40c89bce3ed9d22762085fb2b.exe
1840	b1ad5aa40c89bce3ed9d22762085fb2b.exe
1840	b1ad5aa40c89bce3ed9d22762085fb2b.exe
2556	RttHlp.exe
2556	RttHlp.exe
2556	RttHlp.exe
2556	RttHlp.exe
2556	RttHlp.exe
2388	RttHlp.exe
2388	RttHlp.exe
2388	RttHlp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2388 set thread context of 112	2388	RttHlp.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2556	RttHlp.exe
2388	RttHlp.exe
2388	RttHlp.exe
112	cmd.exe
112	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2388	RttHlp.exe
112	cmd.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1840	1956	b1ad5aa40c89bce3ed9d22762085fb2b.exe	28
PID 1956 wrote to memory of 1840	1956	b1ad5aa40c89bce3ed9d22762085fb2b.exe	28
PID 1956 wrote to memory of 1840	1956	b1ad5aa40c89bce3ed9d22762085fb2b.exe	28
PID 1956 wrote to memory of 1840	1956	b1ad5aa40c89bce3ed9d22762085fb2b.exe	28
PID 1956 wrote to memory of 1840	1956	b1ad5aa40c89bce3ed9d22762085fb2b.exe	28
PID 1956 wrote to memory of 1840	1956	b1ad5aa40c89bce3ed9d22762085fb2b.exe	28
PID 1956 wrote to memory of 1840	1956	b1ad5aa40c89bce3ed9d22762085fb2b.exe	28
PID 1840 wrote to memory of 2556	1840	b1ad5aa40c89bce3ed9d22762085fb2b.exe	29
PID 1840 wrote to memory of 2556	1840	b1ad5aa40c89bce3ed9d22762085fb2b.exe	29
PID 1840 wrote to memory of 2556	1840	b1ad5aa40c89bce3ed9d22762085fb2b.exe	29
PID 1840 wrote to memory of 2556	1840	b1ad5aa40c89bce3ed9d22762085fb2b.exe	29
PID 2556 wrote to memory of 2388	2556	RttHlp.exe	30
PID 2556 wrote to memory of 2388	2556	RttHlp.exe	30
PID 2556 wrote to memory of 2388	2556	RttHlp.exe	30
PID 2556 wrote to memory of 2388	2556	RttHlp.exe	30
PID 2388 wrote to memory of 112	2388	RttHlp.exe	31
PID 2388 wrote to memory of 112	2388	RttHlp.exe	31
PID 2388 wrote to memory of 112	2388	RttHlp.exe	31
PID 2388 wrote to memory of 112	2388	RttHlp.exe	31
PID 2388 wrote to memory of 112	2388	RttHlp.exe	31
PID 112 wrote to memory of 2492	112	cmd.exe	35
PID 112 wrote to memory of 2492	112	cmd.exe	35
PID 112 wrote to memory of 2492	112	cmd.exe	35
PID 112 wrote to memory of 2492	112	cmd.exe	35
PID 112 wrote to memory of 2492	112	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\b1ad5aa40c89bce3ed9d22762085fb2b.exe
"C:\Users\Admin\AppData\Local\Temp\b1ad5aa40c89bce3ed9d22762085fb2b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\Temp\{DB241C6A-A8F8-4BDE-AEE8-44662B88C84D}\.cr\b1ad5aa40c89bce3ed9d22762085fb2b.exe
  "C:\Windows\Temp\{DB241C6A-A8F8-4BDE-AEE8-44662B88C84D}\.cr\b1ad5aa40c89bce3ed9d22762085fb2b.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\b1ad5aa40c89bce3ed9d22762085fb2b.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\Temp\{1FEA6856-9B80-453A-99B0-4A1C4CDF93AB}\.ba\RttHlp.exe
    "C:\Windows\Temp\{1FEA6856-9B80-453A-99B0-4A1C4CDF93AB}\.ba\RttHlp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Users\Admin\AppData\Roaming\TyfConfig_alpha\RttHlp.exe
      "C:\Users\Admin\AppData\Roaming\TyfConfig_alpha\RttHlp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:112
      - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        6⤵
        
        PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

46028607

Path C:\Users\Admin\AppData\Local\Temp\46028607
Size 1.0MB
SHA256 e0bbaa5a186945c49d3c2b6fc0afe4b1f177a5e4642dce1ea8bef4615517a76e
MD5 a6a9d40d69726534e03464c1bea5476a
SHA1 3505c258fb2df80c9f143bc067c60812971a7051
SHA512 01db4d86243e13ab69561902d9f9d36987468a74f26acfb8c4f33a275768984ce285f2f6eeb5bb2949c2b807966c30c6ba6f57ffb332d0d9643e0898b5f89f30
SSDEEP 24576:0XGTXrRE5qdZG/kx/i11kA8Qf+YJSdQG+aYOoFALV:CI6MZG/kx/i11ZD+YJSdBcFALV
MD5 SHA1 SHA512 SSDEEP

Submit Download

hypha.rpm

Path C:\Windows\Temp\{1FEA6856-9B80-453A-99B0-4A1C4CDF93AB}\.ba\hypha.rpm
Size 925KB
SHA256 acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e
MD5 57228f7033c41910e65e5ec66468d42f
SHA1 47b31ee5534e6aca64a17e94ad6176fe18392f90
SHA512 fec6e2102c004f7cb1a3b734ac83f2fb2e588001e21f42cbfc974a97b8bf4b93bfd8e97b109e0bebe28cc93b89c4fc4937e45f5ba507161a6b475a801fa5e6c3
SSDEEP 24576:NZNuGN/A0eeIo7NY+7pQEU2xOzrB0x+jEZeMjj6MkeKsb:hdA0Nt7HQEU2x8B/oZeMjiQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

squirearch.db

Path C:\Windows\Temp\{1FEA6856-9B80-453A-99B0-4A1C4CDF93AB}\.ba\squirearch.db
Size 85KB
SHA256 c69149e6e6e271f7655381ccd513f91eba0f57a2b20b8c4bfbc01a0ca769fc20
MD5 bcc468a592298d4063a354a9a190878c
SHA1 6ea1c4a46b4e03036b338c38d2455fb97ea82a7a
SHA512 3ba6c7100c69fb83db20c80c66b6cd682e68ad4960954ffafb181e109612723474f1f36413c6d6cf7c14ba367f56443aaa26470c089f5e271f75cfa46ba3eab2
SSDEEP 1536:hDODizUv0fdMDV+jr46xH1kr/EvJpEa8442PsJFY8qt7Ycs1w7lTrBSc:hSDico++58IvDEa8z2PsJF5qt7P6c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Patrial.dll

Path \Windows\Temp\{1FEA6856-9B80-453A-99B0-4A1C4CDF93AB}\.ba\Patrial.dll
Size 1.7MB
SHA256 5c1a3808abb0bd02bc2d1dc11d70abc55ce22a256bcd497c126345be3003821b
MD5 1aa6de20bfb2efa4455125dca672167b
SHA1 6ba599163adbab7b6409f8f3807e4c5e2d9b5198
SHA512 be05eabf2769f566ab562750a98b97878d84930c59eb997df263c439024154126c2e6cd578205c3a2f4e1c9e2e36fed58b858ee6b2606826dec37374ae4dd919
SSDEEP 49152:BgQS2wcCKP+vuygTDdmjZwDpU5+MorgByfK3azEDMdV7L5Bem:y2wcCy4jODpxI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path \Windows\Temp\{1FEA6856-9B80-453A-99B0-4A1C4CDF93AB}\.ba\Register.dll
Size 1.0MB
SHA256 87550210bd083496cd991c90dbc6bdb89ee8bf5873f8d8fad8e255c6fc4a5f54
MD5 fe6fde51e5f2397667f8b9424968f55b
SHA1 293154bfda2fd9a882aa39be5da32e8057820130
SHA512 c5d402464181555e39163432a672a64976bbfc4408a699e6c03e6d86eef08acf8cbc91546591587378c1cdda0ccf28b5c685368acc2825c569defd44dd9c3870
SSDEEP 24576:Y0Rdvjw+4ZCWQuT051Qbz27jtBS2Nv+kBT8+u68:1DJ2zAjtpTT3y
MD5 SHA1 SHA512 SSDEEP

Submit Download

RttHlp.exe

Path \Windows\Temp\{1FEA6856-9B80-453A-99B0-4A1C4CDF93AB}\.ba\RttHlp.exe
Size 135KB
SHA256 8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473
MD5 a2d70fbab5181a509369d96b682fc641
SHA1 22afcdc180400c4d2b9e5a6db2b8a26bff54dd38
SHA512 219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83
SSDEEP 1536:URLRDTAC1CMoR1CqabJWt7AQFYMGhw1ScCD28v2Vv428fmvxOuw03h9VC:URdV1CMoiqadTQFBGhw1ED28+94hGw
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtl120.bpl

Path \Windows\Temp\{1FEA6856-9B80-453A-99B0-4A1C4CDF93AB}\.ba\rtl120.bpl
Size 1.1MB
SHA256 d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50
MD5 adf82ed333fb5567f8097c7235b0e17f
SHA1 e6ccaf016fc45edcdadeb40da64c207ddb33859f
SHA512 2253c7b51317a3b5734025b6c7639105dbc81c340703718d679a00c13d40dd74ccaba1f6d04b21ee440f19e82ba680aa4b2a6a75c618aed91bd85a132be9fc92
SSDEEP 24576:GbhVoNWbA1m6z1hGaMopv3RdaK6IPFf0DtDN9Tox0gc:vtQZPTtgc
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcl120.bpl

Path \Windows\Temp\{1FEA6856-9B80-453A-99B0-4A1C4CDF93AB}\.ba\vcl120.bpl
Size 1.9MB
SHA256 572edb7d630e9b03f93bd15135d2ca360176c1232051293663ec5b75c2428aec
MD5 c594d746ff6c99d140b5e8da97f12fd4
SHA1 f21742707c5f3fee776f98641f36bd755e24a7b0
SHA512 33b9902b2cf1154d850779cd012c0285882e158b9d1422c54ea9400ca348686773b6bacb760171060d1a0e620f8ff4a26ecd889dea3c454e8fc5fa59b173832b
SSDEEP 24576:j2gekcIlYas4GaAKBTZTkZbJ7YBRSjr2WLPcgjzTGlyz6F:jRvzfZT3XSmqcOTGc+F
MD5 SHA1 SHA512 SSDEEP

Submit Download

b1ad5aa40c89bce3ed9d22762085fb2b.exe

Path \Windows\Temp\{DB241C6A-A8F8-4BDE-AEE8-44662B88C84D}\.cr\b1ad5aa40c89bce3ed9d22762085fb2b.exe
Size 3.7MB
SHA256 1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac
MD5 ecef3ae99862eb749f2720e9f151cdb3
SHA1 8fe553258dea3c92105b10981bbd012b5d58f735
SHA512 47e55390f2db965754049082a33c164f249c140fe716c214f5de70eb096ab329b7430efe4ff7e483844dec5543bceddeee1fdbd2981fe78698b6fb8f8d657368
SSDEEP 98304:sfUbEBPzHDUZsrqpj4F4i0OY1ZjBpyTvodRYVBAywL8:sfUoPzHDUZsrqpkFraUTvodRGAyV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-122-0x0000000074B90000-0x0000000074D04000-memory.dmp

Download

memory/112-124-0x0000000074B90000-0x0000000074D04000-memory.dmp

Download

memory/112-121-0x0000000074B90000-0x0000000074D04000-memory.dmp

Download

memory/112-75-0x0000000077630000-0x00000000777D9000-memory.dmp

Download

memory/112-70-0x0000000074B90000-0x0000000074D04000-memory.dmp

Download

memory/2388-64-0x0000000074B90000-0x0000000074D04000-memory.dmp

Download

memory/2388-73-0x0000000050120000-0x000000005030D000-memory.dmp

Download

memory/2388-59-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2388-61-0x00000000021C0000-0x00000000022CF000-memory.dmp

Download

memory/2388-74-0x00000000021C0000-0x00000000022CF000-memory.dmp

Download

memory/2388-65-0x0000000077630000-0x00000000777D9000-memory.dmp

Download

memory/2388-66-0x0000000074B90000-0x0000000074D04000-memory.dmp

Download

memory/2388-67-0x0000000074B90000-0x0000000074D04000-memory.dmp

Download

memory/2388-69-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2388-72-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/2492-125-0x0000000000080000-0x00000000000EF000-memory.dmp

Download

memory/2492-130-0x00000000002D0000-0x0000000000551000-memory.dmp

Download

memory/2492-127-0x0000000000080000-0x00000000000EF000-memory.dmp

Download

memory/2492-131-0x0000000000080000-0x00000000000EF000-memory.dmp

Download

memory/2492-126-0x0000000077630000-0x00000000777D9000-memory.dmp

Download

memory/2556-52-0x0000000050000000-0x0000000050116000-memory.dmp

Download

memory/2556-30-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2556-31-0x0000000002370000-0x000000000247F000-memory.dmp

Download

memory/2556-34-0x0000000074770000-0x00000000748E4000-memory.dmp

Download

memory/2556-35-0x0000000077630000-0x00000000777D9000-memory.dmp

Download

memory/2556-49-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2556-54-0x0000000002370000-0x000000000247F000-memory.dmp

Download

memory/2556-53-0x0000000050120000-0x000000005030D000-memory.dmp

Download