Overview
overview
10Static
static
10Release (1).rar
windows7-x64
3Release (1).rar
windows10-2004-x64
3Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1IDTOIPBYR_0.deps.json
windows7-x64
3IDTOIPBYR_0.deps.json
windows10-2004-x64
3IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.pdb
windows7-x64
3IDTOIPBYR_0.pdb
windows10-2004-x64
3IDTOIPBYR_...g.json
windows7-x64
3IDTOIPBYR_...g.json
windows10-2004-x64
3System.Management.dll
windows7-x64
1System.Management.dll
windows10-2004-x64
1Analysis
-
max time kernel
359s -
max time network
360s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 00:05
Behavioral task
behavioral1
Sample
Release (1).rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Release (1).rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Guna.UI2.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Guna.UI2.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
IDTOIPBYR_0.deps.json
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
IDTOIPBYR_0.deps.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
IDTOIPBYR_0.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
IDTOIPBYR_0.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
IDTOIPBYR_0.pdb
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
IDTOIPBYR_0.pdb
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
System.Management.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
System.Management.dll
Resource
win10v2004-20240419-en
General
-
Target
IDTOIPBYR_0.pdb
-
Size
17KB
-
MD5
eaade6e9725fad7772315e2b9d1e82aa
-
SHA1
bd643be28415cbfda78d9e9dc685cee28cbf3651
-
SHA256
664257f7eaea44c12ce83162d278a046cbdc743c21d68ceddb551f7ff7fa030f
-
SHA512
39fbdbb7e34a342695769816f3437eed4fe4d677322a878c561d159bf43f8fb6ed9e1625ccd2405c2e5d2a9234b9e3e3ed38fdeebd6f170543e538d2704d508c
-
SSDEEP
384:Df8jdHvTyslX+A60a09v2osS0HZtOGjBO7QUMbpBkPMg/cpX4rfH8f6Awb3LjBAv:SH7yTTOUeGbpBk0gEUBAv
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pdb rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pdb\ = "pdb_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2580 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2580 AcroRd32.exe 2580 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2268 wrote to memory of 2536 2268 cmd.exe rundll32.exe PID 2268 wrote to memory of 2536 2268 cmd.exe rundll32.exe PID 2268 wrote to memory of 2536 2268 cmd.exe rundll32.exe PID 2536 wrote to memory of 2580 2536 rundll32.exe AcroRd32.exe PID 2536 wrote to memory of 2580 2536 rundll32.exe AcroRd32.exe PID 2536 wrote to memory of 2580 2536 rundll32.exe AcroRd32.exe PID 2536 wrote to memory of 2580 2536 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.pdb1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.pdb2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.pdb"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5e8633b280d14e1ff8fbb486fcf8e3ba8
SHA1f97b37631eb5e796ba4e83a8187b50648c10bb3f
SHA256d4fa118b5f425d48072d6741de6a900c6abe7765b2fde241fc2fb7c692e2fdf5
SHA512d1da523955b5bc5c44849e0e31c442f56139f2954e28319d7ad17d0c083d9aa765726921cecb3965a874f488a93f8a77df77c3118a7000806d0e4a44991deb58