Overview
overview
10Static
static
704995df8cb...e2.exe
windows7-x64
1004995df8cb...e2.exe
windows10-2004-x64
1014b162eed3...66.elf
debian-12-armhf
12cba66d97b...d8.exe
windows7-x64
102cba66d97b...d8.exe
windows10-2004-x64
102f84a18564...bc.elf
debian-12-armhf
1620c15ed6f...8a.elf
ubuntu-20.04-amd64
10623f93cf91...c8.wsf
windows7-x64
8623f93cf91...c8.wsf
windows10-2004-x64
870932cac71...1a.elf
debian-12-armhf
1CAHKHCM2404009CFS.exe
windows7-x64
10CAHKHCM2404009CFS.exe
windows10-2004-x64
10a552331bbe...60.elf
ubuntu-20.04-amd64
9b9d1e862b5...f4.exe
windows7-x64
10b9d1e862b5...f4.exe
windows10-2004-x64
4Michelines.ps1
windows7-x64
8Michelines.ps1
windows10-2004-x64
8f601a6e5b8...bc.elf
debian-12-armhf
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-04-2024 01:20
Behavioral task
behavioral1
Sample
04995df8cbeb0877d5721b8edecaf7d48154b17f8d0bfa61860beba48e30e0e2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04995df8cbeb0877d5721b8edecaf7d48154b17f8d0bfa61860beba48e30e0e2.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
14b162eed3f3f592b5bb6b6b86e817a81834301ce1fe3500a7c328e041a81f66.elf
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral4
Sample
2cba66d97b8af051072417ad7267c9f56f8f74eca98a5e5bf5d7ddc894249ad8.exe
Resource
win7-20240215-en
Behavioral task
behavioral5
Sample
2cba66d97b8af051072417ad7267c9f56f8f74eca98a5e5bf5d7ddc894249ad8.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral6
Sample
2f84a18564ad0853e8c4853a610c42df170a3c0e50316ad65931201a727ff9bc.elf
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral7
Sample
620c15ed6f68b42d2a3b708c340d9ccff7a9217f49ff11effabad58821c7c08a.elf
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral8
Sample
623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8.wsf
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
623f93cf915a4c7e840b51e912221354507f169f6f95121324b4018e33d0d5c8.wsf
Resource
win10v2004-20240412-en
Behavioral task
behavioral10
Sample
70932cac7130ce1561e74c534ba8db2589880a9858bd5b1de4683745576d1b1a.elf
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral11
Sample
CAHKHCM2404009CFS.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
CAHKHCM2404009CFS.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
a552331bbed7ca8a92633b6fcac504884d8a7bc54ce60618dd936f4aa8625560.elf
Resource
ubuntu2004-amd64-20240221-en
Behavioral task
behavioral14
Sample
b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral16
Sample
Michelines.ps1
Resource
win7-20231129-en
Behavioral task
behavioral17
Sample
Michelines.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
f601a6e5b8d78c1f32dbf5fe2cd18cee7ac598cd35fb7aba60526f4df95271bc.elf
Resource
debian12-armhf-20240221-en
General
-
Target
b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe
-
Size
1.1MB
-
MD5
a0e9d68e9a8541eb30d6a31cae4a942b
-
SHA1
3cae987132d7f45df56f77c1ff2a542cb64e64c0
-
SHA256
b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4
-
SHA512
eebfe98652f6b7dffb7e57bdd73c80c073f0f1879ee8a86c17054e1e1ecc3bf5dcec66b4619944659b9038ecfca19254fec0cb60c5264d905382acc8fb0ea03a
-
SSDEEP
24576:c0vvQvOM6sjFYk6IuhdTuvMJbmhQU/YydIE5Ltp:clvpN2zuvMxmhB/Ylyp
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hakkers = "%Philocaly% -windowstyle minimized $Atomlres=(Get-ItemProperty -Path 'HKCU:\\Mayst\\').Fordjelsesbesvrets;%Philocaly% ($Atomlres)" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
wab.exepid process 2088 wab.exe 2088 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 1572 powershell.exe 2088 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1572 set thread context of 2088 1572 powershell.exe wab.exe -
Drops file in Program Files directory 1 IoCs
Processes:
b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\Levantine.ini b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe -
Drops file in Windows directory 2 IoCs
Processes:
b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exedescription ioc process File opened for modification C:\Windows\Fonts\tashlik.ini b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe File opened for modification C:\Windows\resources\0409\marmoreret.ini b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepid process 1572 powershell.exe 1572 powershell.exe 1572 powershell.exe 1572 powershell.exe 1572 powershell.exe 1572 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 1572 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1572 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exepowershell.exewab.execmd.exedescription pid process target process PID 2292 wrote to memory of 1572 2292 b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe powershell.exe PID 2292 wrote to memory of 1572 2292 b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe powershell.exe PID 2292 wrote to memory of 1572 2292 b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe powershell.exe PID 2292 wrote to memory of 1572 2292 b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe powershell.exe PID 1572 wrote to memory of 1364 1572 powershell.exe cmd.exe PID 1572 wrote to memory of 1364 1572 powershell.exe cmd.exe PID 1572 wrote to memory of 1364 1572 powershell.exe cmd.exe PID 1572 wrote to memory of 1364 1572 powershell.exe cmd.exe PID 1572 wrote to memory of 2088 1572 powershell.exe wab.exe PID 1572 wrote to memory of 2088 1572 powershell.exe wab.exe PID 1572 wrote to memory of 2088 1572 powershell.exe wab.exe PID 1572 wrote to memory of 2088 1572 powershell.exe wab.exe PID 1572 wrote to memory of 2088 1572 powershell.exe wab.exe PID 1572 wrote to memory of 2088 1572 powershell.exe wab.exe PID 2088 wrote to memory of 1216 2088 wab.exe cmd.exe PID 2088 wrote to memory of 1216 2088 wab.exe cmd.exe PID 2088 wrote to memory of 1216 2088 wab.exe cmd.exe PID 2088 wrote to memory of 1216 2088 wab.exe cmd.exe PID 1216 wrote to memory of 1936 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1936 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1936 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1936 1216 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe"C:\Users\Admin\AppData\Local\Temp\b9d1e862b5f864aab90e418632cf973132a4b4cbe4044b1fb997d9dfbd7ad0f4.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Bissede=Get-Content 'C:\Users\Admin\AppData\Local\nervier\Estampede\sipunculacean\Michelines.All';$Flumes35=$Bissede.SubString(58005,3);.$Flumes35($Bissede)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"3⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Hakkers" /t REG_EXPAND_SZ /d "%Philocaly% -windowstyle minimized $Atomlres=(Get-ItemProperty -Path 'HKCU:\Mayst\').Fordjelsesbesvrets;%Philocaly% ($Atomlres)"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Hakkers" /t REG_EXPAND_SZ /d "%Philocaly% -windowstyle minimized $Atomlres=(Get-ItemProperty -Path 'HKCU:\Mayst\').Fordjelsesbesvrets;%Philocaly% ($Atomlres)"5⤵
- Adds Run key to start application
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD503034a68e3b1b0a8a23b448ee4f2a139
SHA17090f7fb26f1061bc770348500a50922fee507f0
SHA25680c7c3141fdd1c75d0ba0fa86e0779f50aebd797c85a867e3795b92064204d8f
SHA512d5b7b386d30ee7d7cc0c36acffd6ece8751b7434fa33504cab33b1e48a8183074d42bd33989e8f972e670bdf7670ac21d74b7068c59305665615ab339f337edd
-
C:\Users\Admin\AppData\Local\Temp\Cab6135.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar638D.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\nervier\Estampede\sipunculacean\Indskrnkningens.MegFilesize
301KB
MD550196fec4abccdb71d5f26eccdffb22b
SHA1594f16df70de47019f285b72d39130885837a238
SHA256592aa331c37790bb4627428385c85f843d839f2ebda2f621da438afb4edfe13d
SHA5126a547e0c03fc7748b9637fa9c90784e30c4433d09b0488882d6b6792b41188a9ae2efa39f649da596d37d1079715842df315cae8fcdaf1482a5d804737d2192c
-
C:\Users\Admin\AppData\Local\nervier\Estampede\sipunculacean\Michelines.AllFilesize
56KB
MD582340892cba1f6e4faaa080bb634cf9c
SHA156b029cbcada747897e9beff7c8f1013b8c9b6ce
SHA256a03bb54517df231824d324ad20b79094efef9af20eff855e30a6f459bcc43912
SHA512dfea5297d9aef9004af38f8604e74313f99d477199e797dbeec5367ec3e6c0000a4c62eeab54425deee14de5b1adb224f09956a10619cf03b821b2b91b84f5c7
-
memory/1572-18-0x0000000073E90000-0x000000007443B000-memory.dmpFilesize
5.7MB
-
memory/1572-19-0x00000000025D0000-0x0000000002610000-memory.dmpFilesize
256KB
-
memory/1572-30-0x00000000025D0000-0x0000000002610000-memory.dmpFilesize
256KB
-
memory/1572-25-0x0000000006570000-0x00000000092C6000-memory.dmpFilesize
45.3MB
-
memory/1572-26-0x0000000077440000-0x00000000775E9000-memory.dmpFilesize
1.7MB
-
memory/1572-27-0x0000000077630000-0x0000000077706000-memory.dmpFilesize
856KB
-
memory/1572-119-0x0000000006570000-0x00000000092C6000-memory.dmpFilesize
45.3MB
-
memory/1572-29-0x0000000073E90000-0x000000007443B000-memory.dmpFilesize
5.7MB
-
memory/1572-24-0x0000000006570000-0x00000000092C6000-memory.dmpFilesize
45.3MB
-
memory/1572-17-0x00000000025D0000-0x0000000002610000-memory.dmpFilesize
256KB
-
memory/1572-21-0x00000000025D0000-0x0000000002610000-memory.dmpFilesize
256KB
-
memory/1572-23-0x00000000055A0000-0x00000000055A4000-memory.dmpFilesize
16KB
-
memory/1572-16-0x0000000073E90000-0x000000007443B000-memory.dmpFilesize
5.7MB
-
memory/2088-32-0x0000000077630000-0x0000000077706000-memory.dmpFilesize
856KB
-
memory/2088-33-0x0000000077666000-0x0000000077667000-memory.dmpFilesize
4KB
-
memory/2088-120-0x0000000077630000-0x0000000077706000-memory.dmpFilesize
856KB
-
memory/2088-117-0x0000000001DA0000-0x0000000004AF6000-memory.dmpFilesize
45.3MB
-
memory/2088-28-0x0000000001DA0000-0x0000000004AF6000-memory.dmpFilesize
45.3MB
-
memory/2088-31-0x0000000077440000-0x00000000775E9000-memory.dmpFilesize
1.7MB