Overview
overview
10Static
static
10Release (1).rar
windows7-x64
3Release (1).rar
windows10-2004-x64
3Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1IDTOIPBYR_0.deps.json
windows7-x64
3IDTOIPBYR_0.deps.json
windows10-2004-x64
3IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.pdb
windows7-x64
3IDTOIPBYR_0.pdb
windows10-2004-x64
3IDTOIPBYR_...g.json
windows7-x64
3IDTOIPBYR_...g.json
windows10-2004-x64
3System.Management.dll
windows7-x64
1System.Management.dll
windows10-2004-x64
1Analysis
-
max time kernel
357s -
max time network
358s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 00:05
Behavioral task
behavioral1
Sample
Release (1).rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Release (1).rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Guna.UI2.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Guna.UI2.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
IDTOIPBYR_0.deps.json
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
IDTOIPBYR_0.deps.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
IDTOIPBYR_0.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
IDTOIPBYR_0.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
IDTOIPBYR_0.pdb
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
IDTOIPBYR_0.pdb
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
System.Management.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
System.Management.dll
Resource
win10v2004-20240419-en
General
-
Target
IDTOIPBYR_0.runtimeconfig.json
-
Size
458B
-
MD5
07b9a30265ca4e69c7016a1b6e3ffc27
-
SHA1
3a4af82a2695b1423aedd8b60a5c86793c011b02
-
SHA256
c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782
-
SHA512
efd582f8edcdba5ef48d02eee5f73d83ff35071af99b49e08e0213928568d728d0856e3b903bfcccb9237f786846cf94da83139f99e9bee86287aff2071c3f1c
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.json rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2548 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2548 AcroRd32.exe 2548 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1504 wrote to memory of 2564 1504 cmd.exe rundll32.exe PID 1504 wrote to memory of 2564 1504 cmd.exe rundll32.exe PID 1504 wrote to memory of 2564 1504 cmd.exe rundll32.exe PID 2564 wrote to memory of 2548 2564 rundll32.exe AcroRd32.exe PID 2564 wrote to memory of 2548 2564 rundll32.exe AcroRd32.exe PID 2564 wrote to memory of 2548 2564 rundll32.exe AcroRd32.exe PID 2564 wrote to memory of 2548 2564 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.runtimeconfig.json1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.runtimeconfig.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.runtimeconfig.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD506e4ff8d561d7eedd6ecb6388f6eab0e
SHA138639f7ea62292d11d50e161e7a42bfccfb70c06
SHA2565e9fa4a68d66b5c90ff2811f3dfc944a6efb9e6f40006b1769217bdce0bd921b
SHA51297758220c53bde0083095a77c0457659f2af44e75d2a5a089a21c47d705aafc39209792a4d654611e7643f9189bdf9604fd55d758ebdbbfceb9e5c95e5a86bd5