Resubmissions
07-05-2024 12:36
240507-pta39afh8x 1007-05-2024 12:36
240507-ps89nafh8t 1007-05-2024 12:36
240507-ps7qtsae72 1007-05-2024 12:36
240507-ps65asfh7y 1007-05-2024 12:36
240507-ps4deafh7w 825-04-2024 13:15
240425-qg8z7abb48 7Analysis
-
max time kernel
981s -
max time network
1801s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-05-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win11-20240426-en
General
-
Target
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
-
Size
1.8MB
-
MD5
74f0926d93b595bb0a97d12fcced1f0e
-
SHA1
057b3c704de258d5b858afc884495405af2c7426
-
SHA256
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b
-
SHA512
08f4b6a7ce8104180e538c2999115bc6cba33f3a66564db1b8369100bdbb540296207233cd25441c97f5ada1f4711c7ad4f12b18cc843ce0e9f719852444622a
-
SSDEEP
49152:VFqIJny8yP43p0p3PvdvN71jdII5rYjsAIGi:VFqmnbc45YVN71y1AGi
Malware Config
Extracted
Protocol: ftp- Host:
cv01.panaccess.com - Port:
21 - Username:
[email protected] - Password:
Merotv_2018
Extracted
Protocol: ftp- Host:
cv01.panaccess.com - Port:
21 - Username:
dst_byyt_batra - Password:
Merotv_2018
Extracted
Protocol: ftp- Host:
cv01.panaccess.com - Port:
21 - Username:
admin - Password:
Merotv_2018
Extracted
Protocol: ftp- Host:
cv01.panaccess.com - Port:
21 - Username:
cv01 - Password:
Merotv_2018
Extracted
Protocol: ftp- Host:
escritoriolacqua.com - Port:
21 - Username:
[email protected] - Password:
felipe1265
Extracted
Protocol: ftp- Host:
ftp.escritoriolacqua.com - Port:
21 - Username:
[email protected] - Password:
felipe1265
Extracted
Protocol: ftp- Host:
ftp.escritoriolacqua.com - Port:
21 - Username:
francisco - Password:
felipe1265
Extracted
Protocol: ftp- Host:
ftp.escritoriolacqua.com - Port:
21 - Username:
admin - Password:
felipe1265
Extracted
Protocol: ftp- Host:
ftp.escritoriolacqua.com - Port:
21 - Username:
escritoriolacqua - Password:
felipe1265
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Contacts a large (1305) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Processes:
resource yara_rule behavioral5/memory/1564-2-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-7-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-6-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-5-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-8-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-9-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-14-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-15-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-16-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-25-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-33-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-42-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-48-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-52-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-53-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-54-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-71-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-70-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-106-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-104-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-103-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-100-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-99-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-98-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-97-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-95-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-94-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-92-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-91-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-86-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-85-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-84-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-82-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-81-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-80-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-77-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-75-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-73-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-72-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-69-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-68-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-67-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-65-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-63-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-61-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-59-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-105-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-96-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-93-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-58-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-90-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-87-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-83-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-56-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-79-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-78-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-76-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-74-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-66-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-64-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-60-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-57-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/1564-55-0x0000000000400000-0x0000000000848000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 62 IoCs
Processes:
flow ioc 36368 discord.com 67990 discord.com 99018 discord.com 12532 drive.google.com 15162 discord.com 67665 discord.com 70944 pastebin.com 67741 discord.com 86352 pastebin.com 98850 discord.com 98893 discord.com 11402 drive.google.com 11804 drive.google.com 12175 drive.google.com 12850 drive.google.com 13543 drive.google.com 551 discord.com 12514 drive.google.com 67636 discord.com 70708 pastebin.com 83064 discord.com 99035 discord.com 99057 discord.com 642 discord.com 12831 drive.google.com 34422 discord.com 13217 drive.google.com 46449 drive.google.com 70734 pastebin.com 67405 discord.com 67700 discord.com 67869 discord.com 70893 pastebin.com 98902 discord.com 33 discord.com 11355 drive.google.com 13903 drive.google.com 99052 discord.com 99069 discord.com 68050 discord.com 70841 pastebin.com 70854 pastebin.com 98698 discord.com 13233 drive.google.com 29585 drive.google.com 70651 pastebin.com 67907 discord.com 69798 pastebin.com 70534 pastebin.com 70815 pastebin.com 1788 discord.com 12022 drive.google.com 67847 discord.com 67593 discord.com 70759 pastebin.com 99190 discord.com 67928 discord.com 70667 pastebin.com 70814 pastebin.com 67783 discord.com 98723 discord.com 99034 discord.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exedescription pid process target process PID 396 set thread context of 1564 396 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exepid process 1564 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 1564 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 1564 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 1564 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 1564 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 1564 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exedescription pid process target process PID 396 wrote to memory of 1564 396 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 396 wrote to memory of 1564 396 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 396 wrote to memory of 1564 396 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 396 wrote to memory of 1564 396 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 396 wrote to memory of 1564 396 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 396 wrote to memory of 1564 396 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 396 wrote to memory of 1564 396 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 396 wrote to memory of 1564 396 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensusFilesize
2.4MB
MD50ce4530144899e61e7151afe7810919f
SHA1f300561ff8bbd2b426926aced1e576bd2b91d001
SHA25659f1410ba288f348e46546682bc8ae589accfdb2abc49b0b59fed35ed9de32e5
SHA512595a94b645837f8627b703920cec6eda3e6103ae964c91c383679f00b712343b7f8d4656db6efdaceabe8c641cf45d6461ff77cc9fafa263880bc1a0763a83e6
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.newFilesize
7.9MB
MD5dc112842ab6750fe46948196f097d9d6
SHA1e2eb63d6af5f0924ab6f40886595649f43bab59d
SHA256b42e62cec43a71bd0f605fc2f9beacae537d1a21d31a13aa5de320bb471a2a75
SHA51214940a8579a5d641a6c0fa4b44c5598cd5927623720a80ea8a3bad82ef12dfca9dd6dadb63bd7329bdbde6b6ef2f4b0b402c6940d4e04c734f78e5011baf716c
-
memory/396-1-0x0000000004D10000-0x0000000004ED8000-memory.dmpFilesize
1.8MB
-
memory/396-3-0x0000000004B40000-0x0000000004CF7000-memory.dmpFilesize
1.7MB
-
memory/1564-2-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-7-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-6-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-5-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-8-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-9-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-14-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-15-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-16-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-25-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-33-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-42-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-48-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-52-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-53-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-54-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-71-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-70-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-106-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-104-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-103-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-100-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-99-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-98-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-97-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-95-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-94-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-92-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-91-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-86-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-85-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-84-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-82-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-81-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-80-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-77-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-75-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-73-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-72-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-69-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-68-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-67-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-65-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-63-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-61-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-59-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-105-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-96-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-93-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-58-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-90-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-87-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-83-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-56-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-79-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-78-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-76-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-74-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-66-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-64-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-60-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-57-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1564-55-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB