Analysis
-
max time kernel
67s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 18:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Inazuma.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Inazuma.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Inazuma.exe
-
Size
35.8MB
-
MD5
4f87e755e07ef688dc899e7f5ffdc283
-
SHA1
a93b9dc51c2d72a8e4bc311c29f72f572b293d97
-
SHA256
41b1b8220f1f700712831d790a8e4dd8fd552748e445c6611ad0f9c7b2dd1d8b
-
SHA512
5f5af06dbb27908fa450dfdb093a884f79217c6f29060076d855a59b0b63e5f3021b90e060f9538657e97268287802e5a948f43845995ba092d48ca53f202d68
-
SSDEEP
786432:K7ACT5+AN6fQKQNDA1H2Bwd7ZlbCqE9kG3YUPS:K7ACTIsXzNDuH2w7PbJE3RS
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Inazuma.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 api.ipify.org 17 api.ipify.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Inazuma.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Inazuma.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe 2480 Inazuma.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2480 Inazuma.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2280 taskmgr.exe Token: SeSystemProfilePrivilege 2280 taskmgr.exe Token: SeCreateGlobalPrivilege 2280 taskmgr.exe Token: SeSecurityPrivilege 2280 taskmgr.exe Token: SeTakeOwnershipPrivilege 2280 taskmgr.exe Token: 33 2280 taskmgr.exe Token: SeIncBasePriorityPrivilege 2280 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe 2280 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2480 wrote to memory of 1416 2480 Inazuma.exe 99 PID 2480 wrote to memory of 1416 2480 Inazuma.exe 99 PID 2480 wrote to memory of 3492 2480 Inazuma.exe 101 PID 2480 wrote to memory of 3492 2480 Inazuma.exe 101 PID 3492 wrote to memory of 2004 3492 cmd.exe 102 PID 3492 wrote to memory of 2004 3492 cmd.exe 102 PID 3492 wrote to memory of 4664 3492 cmd.exe 103 PID 3492 wrote to memory of 4664 3492 cmd.exe 103 PID 3492 wrote to memory of 4216 3492 cmd.exe 104 PID 3492 wrote to memory of 4216 3492 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inazuma.exe"C:\Users\Admin\AppData\Local\Temp\Inazuma.exe"1⤵
- Drops file in Drivers directory
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Cls2⤵PID:1416
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Inazuma.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Inazuma.exe" MD53⤵PID:2004
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:4664
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4216
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2280
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4332