Malware Analysis Report

2025-03-14 22:27

Sample ID 240407-3bx2yshe81
Target 8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f
SHA256 8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f

Threat Level: Shows suspicious behavior

The file 8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 23:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 23:20

Reported

2024-04-07 23:23

Platform

win7-20240220-en

Max time kernel

148s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\grkwn.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\grkwn.exe" C:\ProgramData\grkwn.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f.exe

"C:\Users\Admin\AppData\Local\Temp\8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f.exe"

C:\ProgramData\grkwn.exe

"C:\ProgramData\grkwn.exe"

Network

N/A

Files

memory/1724-0-0x0000000000400000-0x0000000000474000-memory.dmp

memory/1724-1-0x0000000000400000-0x0000000000474000-memory.dmp

\ProgramData\grkwn.exe

MD5 7b0b4fb8941a0def1cbbf90a8d70d9f1
SHA1 32090658aee82fe8bbe9090b0f3e4a33927c8e58
SHA256 238072443c375a5cca413ec01b4ea85a5b55ae34b06cb3737ee8c57115e6d85c
SHA512 cab98835fadd6fa8d1fc0054247fdf0b8da0a443f9667ad4c9fb6b8298ed59647169936a69b5047c486ac61869a6b0c9bfee9ec4cb52865e3761f2f305c41a4a

C:\ProgramData\Saaaalamm\Mira.h

MD5 cb4c442a26bb46671c638c794bf535af
SHA1 8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf
SHA256 f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25
SHA512 074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

C:\Documents and Settings .exe

MD5 b132c82b4fdb4546392991fe773389e7
SHA1 20a5b17db9c418fa3eeceb0eb9851874e27638ab
SHA256 2498f4d7bf895677073ec1e19edc3ffdb53f19ff35f09d4eb2135014c0266fe3
SHA512 bcfb5338b905581e9f5974e6bf59c2d5bb2e14fd4a715d79c00da8bdd43b7fd6c66b64b82bae1a9ac3e29faa01099593576893341a3217702e59c4bded6c1aa2

memory/1724-14-0x0000000000400000-0x0000000000474000-memory.dmp

memory/2332-133-0x0000000000400000-0x0000000000448000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 23:20

Reported

2024-04-07 23:23

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\fhfmp.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\fhfmp.exe" C:\ProgramData\fhfmp.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f.exe

"C:\Users\Admin\AppData\Local\Temp\8ffe5404429a410caa2fb860e8629a5988e4d06f300963e87a7aeb3c3f25d20f.exe"

C:\ProgramData\fhfmp.exe

"C:\ProgramData\fhfmp.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp

Files

memory/3060-0-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3060-1-0x0000000000400000-0x0000000000474000-memory.dmp

C:\ProgramData\fhfmp.exe

MD5 7b0b4fb8941a0def1cbbf90a8d70d9f1
SHA1 32090658aee82fe8bbe9090b0f3e4a33927c8e58
SHA256 238072443c375a5cca413ec01b4ea85a5b55ae34b06cb3737ee8c57115e6d85c
SHA512 cab98835fadd6fa8d1fc0054247fdf0b8da0a443f9667ad4c9fb6b8298ed59647169936a69b5047c486ac61869a6b0c9bfee9ec4cb52865e3761f2f305c41a4a

C:\ProgramData\Saaaalamm\Mira.h

MD5 cb4c442a26bb46671c638c794bf535af
SHA1 8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf
SHA256 f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25
SHA512 074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

memory/3060-9-0x0000000000400000-0x0000000000474000-memory.dmp

C:\DumpStack.log.tmp .exe

MD5 cee7b9d5ba8de9ad2f9d39ff4b637f78
SHA1 993bec5e199441b38b29f96abe372ab5dffcc021
SHA256 f5134a54649a59dbabfef61b9ccb7eeffd6947d880b3a9d1317c99e913293905
SHA512 be8867f81bce6b817e1741b3a608b26a17b7699716de7e4fe85b0a9f28af9849167eaebf2e726a95ee0e7005fc4b3eef56c3b1ceba6a5b82db9887ac717f9f9c

memory/4204-130-0x0000000000400000-0x0000000000448000-memory.dmp