Overview
overview
10Static
static
331c0d26c2e...29.exe
windows7-x64
1031c0d26c2e...29.exe
windows10-2004-x64
10$TEMP/55.opends60.dll
windows7-x64
1$TEMP/55.opends60.dll
windows10-2004-x64
1$TEMP/CMAccept.exe
windows7-x64
$TEMP/CMAccept.exe
windows10-2004-x64
$TEMP/DevCfgUI.dll
windows7-x64
1$TEMP/DevCfgUI.dll
windows10-2004-x64
1$TEMP/Samp...ll.exe
windows7-x64
1$TEMP/Samp...ll.exe
windows10-2004-x64
1$TEMP/Umbellule.dll
windows7-x64
1$TEMP/Umbellule.dll
windows10-2004-x64
1$TEMP/VJUp...UI.dll
windows7-x64
1$TEMP/VJUp...UI.dll
windows10-2004-x64
1$TEMP/WebC...orm.js
windows7-x64
1$TEMP/WebC...orm.js
windows10-2004-x64
1$TEMP/Wiza...VS.dll
windows7-x64
1$TEMP/Wiza...VS.dll
windows10-2004-x64
1$TEMP/aspn...er.exe
windows7-x64
1$TEMP/aspn...er.exe
windows10-2004-x64
1$TEMP/libu...b.so.0
ubuntu-18.04-amd64
1$TEMP/pdfg...36.pyc
windows7-x64
3$TEMP/pdfg...36.pyc
windows10-2004-x64
3$TEMP/plier.exe
windows7-x64
4$TEMP/plier.exe
windows10-2004-x64
10Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
31c0d26c2edd1b2d59a360ce272eb19ffed3b630757e94336a75c2e1e6a3f729.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
31c0d26c2edd1b2d59a360ce272eb19ffed3b630757e94336a75c2e1e6a3f729.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$TEMP/55.opends60.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$TEMP/55.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/CMAccept.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMP/CMAccept.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/DevCfgUI.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/DevCfgUI.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$TEMP/SampDBInstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$TEMP/SampDBInstall.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$TEMP/Umbellule.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$TEMP/Umbellule.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
$TEMP/VJUpgradePackageUI.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$TEMP/VJUpgradePackageUI.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$TEMP/WebClientProgressForm.js
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
$TEMP/WebClientProgressForm.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$TEMP/WizardFrameworkVS.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$TEMP/WizardFrameworkVS.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$TEMP/aspnetcompiler.exe
Resource
win7-20240319-en
Behavioral task
behavioral20
Sample
$TEMP/aspnetcompiler.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$TEMP/libutil-tdb.so.0
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral22
Sample
$TEMP/pdfgeom.cpython-36.pyc
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
$TEMP/pdfgeom.cpython-36.pyc
Resource
win10v2004-20231215-en
Behavioral task
behavioral24
Sample
$TEMP/plier.exe
Resource
win7-20240220-en
General
-
Target
$TEMP/plier.exe
-
Size
4KB
-
MD5
11c8f037f0e1a68ff1c74cbcac6e3c6e
-
SHA1
bb50ac196dfd3a194b7b7161947a012a0d49886c
-
SHA256
aed09c9a90b38e324fa49b4b8b5b6e263413b49768d5b38f921c2ee4245a6b34
-
SHA512
05da2d9cd1ce41a11d4ba0f82512790357139c815894f1be4468df137680ecd577660807c368d9c9c6e95aad10e2caa0f00cf1c5739b36644c75a2e8eeae6c2b
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini plier.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2732 plier.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2732 plier.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 2732 wrote to memory of 3852 2732 plier.exe 28 PID 3852 wrote to memory of 4164 3852 cmd.exe 30 PID 3852 wrote to memory of 4164 3852 cmd.exe 30 PID 3852 wrote to memory of 4164 3852 cmd.exe 30 PID 3852 wrote to memory of 4164 3852 cmd.exe 30 PID 3852 wrote to memory of 4224 3852 cmd.exe 32 PID 3852 wrote to memory of 4224 3852 cmd.exe 32 PID 3852 wrote to memory of 4224 3852 cmd.exe 32 PID 3852 wrote to memory of 4224 3852 cmd.exe 32 PID 3852 wrote to memory of 4368 3852 cmd.exe 36 PID 3852 wrote to memory of 4368 3852 cmd.exe 36 PID 3852 wrote to memory of 4368 3852 cmd.exe 36 PID 3852 wrote to memory of 4368 3852 cmd.exe 36 PID 3852 wrote to memory of 4436 3852 cmd.exe 38 PID 3852 wrote to memory of 4436 3852 cmd.exe 38 PID 3852 wrote to memory of 4436 3852 cmd.exe 38 PID 3852 wrote to memory of 4436 3852 cmd.exe 38 PID 3852 wrote to memory of 4504 3852 cmd.exe 40 PID 3852 wrote to memory of 4504 3852 cmd.exe 40 PID 3852 wrote to memory of 4504 3852 cmd.exe 40 PID 3852 wrote to memory of 4504 3852 cmd.exe 40 PID 3852 wrote to memory of 4572 3852 cmd.exe 42 PID 3852 wrote to memory of 4572 3852 cmd.exe 42 PID 3852 wrote to memory of 4572 3852 cmd.exe 42 PID 3852 wrote to memory of 4572 3852 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\plier.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\plier.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\diskshadow.exe""3⤵PID:4164
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\diskshadow.exe""3⤵PID:4224
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\diskshadow.exe""3⤵PID:4368
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\diskshadow.exe""3⤵PID:4436
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\diskshadow.exe""3⤵PID:4504
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\diskshadow.exe""3⤵PID:4572
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517B
MD5893cae59ab5945a94a7da007d47a1255
SHA1d4cfd81c6647ca64022bd307c08a7fb4bbbd4c06
SHA256edfa0f2d3bea9f737e0315971c6f81d3d8e7d460b60a19351ada0316a093c938
SHA512d66e454781f54f45df814ad32d687b0f100578c2a4ffca62de81add04281fb881a550702bd2d058933d3736d14e88624af268a86ce24b0c3935242b206ffdcc9