Analysis
-
max time kernel
93s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2024 21:58
Static task
static1
Behavioral task
behavioral1
Sample
f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe
Resource
win7-20240221-en
General
-
Target
f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe
-
Size
132KB
-
MD5
1c434fa39f6b740903cc38d70265e0d2
-
SHA1
caa51b5e078df5ae4fbc45379fc3a97c8d337a41
-
SHA256
f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc
-
SHA512
c5c2a402c46d740b96a40358ded8ac505907e393f69c21736c0a67b02a36e14737e598a4cb067ad440832a6d20ec59f5e0bdcab71191cc93775d867437775fee
-
SSDEEP
3072:MftffhJCuEmUcCSjGoLpIZ8plqS0b2obE4dea7zeWdkm1SXcmEd:UVfhgujHXIZ3aWdn7ze+km1SXcmG
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation cmd.exe -
Processes:
resource yara_rule behavioral2/memory/2612-1-0x00000000007F0000-0x000000000187E000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
Processes:
f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exedescription ioc process File created C:\Windows\rundl132.exe f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe File created C:\Windows\Logo1_.exe f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 3096 cmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exedescription pid process target process PID 2612 wrote to memory of 3096 2612 f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe cmd.exe PID 2612 wrote to memory of 3096 2612 f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe cmd.exe PID 2612 wrote to memory of 3096 2612 f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe"C:\Users\Admin\AppData\Local\Temp\f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43C0.bat2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\$$a43C0.batFilesize
722B
MD5dd087110b1ce52faf2550ec19377f5f6
SHA1f416c82b96e141700f47704cef38dd3615879e8c
SHA2569b7379be5b42f85f55311f1555ac8d105bc3f8cee1d53f7580b11f05613438b8
SHA51290d2c4045d98eca363504384ec573fe9d4b47bffa6ae9af7f4dbb51beb766a6026cfcb1d7b5f9a1f4d28eff54cae888c65b20bda34451017ebff1e33ad40ec0c
-
C:\Users\Admin\AppData\Local\Temp\f9846d5963dbf3552e86fb429e8e0dc9b68c60c314c2080464b8a765dc93bffc.exe.exeFilesize
105KB
MD571c2f15e50ae1118973f583bebb8e995
SHA113d32803d3d807b0a7b887fea47f79ee988feed3
SHA2561f5bb5b31e7f2868095ddca6e7d5d8017684d6cb8e4285891a8367638522f0fe
SHA512125a0ed75578d039ccf825852baf763bc710d119da08231dd882b0d7726d0ce272d7fd39868cb5684978967ef820fa06584fdc579e44864424bf5d1fd4089bde
-
memory/2612-0-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/2612-1-0x00000000007F0000-0x000000000187E000-memory.dmpFilesize
16.6MB
-
memory/2612-8-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB