Overview
overview
10Static
static
32769155d03...ae.exe
windows7-x64
102769155d03...ae.exe
windows10-2004-x64
7$APPDATA/2...ib.dll
windows7-x64
1$APPDATA/2...ib.dll
windows10-2004-x64
1$APPDATA/2...rs.exe
windows7-x64
1$APPDATA/2...rs.exe
windows10-2004-x64
1$APPDATA/2...ll.dll
windows7-x64
1$APPDATA/2...ll.dll
windows10-2004-x64
1$APPDATA/2...00.dll
windows7-x64
3$APPDATA/2...00.dll
windows10-2004-x64
3$APPDATA/2...DC.dll
windows7-x64
1$APPDATA/2...DC.dll
windows10-2004-x64
1$APPDATA/p...60.dll
windows7-x64
1$APPDATA/p...60.dll
windows10-2004-x64
1$APPDATA/p...HS.dll
windows7-x64
1$APPDATA/p...HS.dll
windows10-2004-x64
1$APPDATA/p...ps.dll
windows7-x64
1$APPDATA/p...ps.dll
windows10-2004-x64
1$APPDATA/p...80.dll
windows7-x64
1$APPDATA/p...80.dll
windows10-2004-x64
1$APPDATA/p...ui.dll
windows7-x64
1$APPDATA/p...ui.dll
windows10-2004-x64
1$TEMP/Abou...60.dll
windows7-x64
1$TEMP/Abou...60.dll
windows10-2004-x64
1$TEMP/Shoo...sm.dll
windows7-x64
1$TEMP/Shoo...sm.dll
windows10-2004-x64
1$TEMP/usr/...60.dll
windows7-x64
1$TEMP/usr/...60.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$APPDATA/24/remind/domains/SERVERLib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$APPDATA/24/remind/domains/SERVERLib.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$APPDATA/24/remind/domains/aspnetregbrowsers.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$APPDATA/24/remind/domains/aspnetregbrowsers.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$APPDATA/24/remind/domains/lregdll.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$APPDATA/24/remind/domains/lregdll.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$APPDATA/24/remind/domains/u2l2000.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$APPDATA/24/remind/domains/u2l2000.dll
Resource
win10v2004-20240319-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$APPDATA/24/remind/domains/wbemDC.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$APPDATA/24/remind/domains/wbemDC.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$APPDATA/post/60.opends60.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$APPDATA/post/60.opends60.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$APPDATA/post/MFC80CHS.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
$APPDATA/post/MFC80CHS.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$APPDATA/post/edbgps.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral18
Sample
$APPDATA/post/edbgps.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$APPDATA/post/pgort80.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
$APPDATA/post/pgort80.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$APPDATA/post/vsamui.dll
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral22
Sample
$APPDATA/post/vsamui.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$TEMP/AboutUs/errata/15.opends60.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
$TEMP/AboutUs/errata/15.opends60.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$TEMP/ShoonCataclysm.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
$TEMP/ShoonCataclysm.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$TEMP/usr/61.opends60.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral28
Sample
$TEMP/usr/61.opends60.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae.exe
-
Size
371KB
-
MD5
8f1af8760a7dfd7571a19bc74a9960b3
-
SHA1
b5ed4d1cb148709e77d88b917ffdd858153c14ca
-
SHA256
2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae
-
SHA512
23225e5164333abcc31a829136f2287f684b27ac2e33cd2cba0cea853bac9a92e1087dd43878440d433f643d3718110d73fbf7575403652d5490f2c5cf496f1c
-
SSDEEP
6144:9PCganNFIuaTlVKeKUaHXtt16TbFa4YjsVyG9DBeslx5EUyDjWoGwcyZQDQxmEjo:janAua5seraHXZ6H0G9DBew6Djm5DFEU
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 920 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 920 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 920 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe Token: 33 3120 MSBuild.exe Token: SeIncBasePriorityPrivilege 3120 MSBuild.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3196 wrote to memory of 920 3196 2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae.exe 88 PID 3196 wrote to memory of 920 3196 2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae.exe 88 PID 3196 wrote to memory of 920 3196 2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae.exe 88 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89 PID 920 wrote to memory of 3120 920 rundll32.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae.exe"C:\Users\Admin\AppData\Local\Temp\2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe ShoonCataclysm,Uboats2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD57146f402cb274c4ee438880fbadd3cc3
SHA177e9318268e495ace3e6abe8fbf36abf05fffcd1
SHA256e48d999b469cdf15f82abb61ad8d52c72932a218873184319f5a1514f1110f46
SHA5128b8dd050bd3b158f2f370799381db94753a2b7e808121a4103e0665b9dd747732aad473ad1750d23879001256afd8b5c32ad68b7e519e6aacbe9cfa120687abc
-
Filesize
48KB
MD56864b4b87cb50d998f8c3d583e0e5bf3
SHA1c90c3de34d735e40a81e42254f60453ac8cff190
SHA256178b978482f6ede2219513d9dbbce2df3d09e188114a8eb4caca7d4390c03f17
SHA5122db7f163c3364fdb2e06e8c67062f2fdcf243358fe9d156e3da0ccac3876e75e4870450e20cd46e67b1ce32ee59231e81ef7ccf0c6af432d4061c93667e4feba