Overview
overview
10Static
static
3Centrotus.exe
windows7-x64
10Centrotus.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Flexibel/P...er.jad
windows7-x64
3Flexibel/P...er.jad
windows10-2004-x64
3Synfuel/Huspil81.asp
windows7-x64
3Synfuel/Huspil81.asp
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
Centrotus.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Centrotus.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Flexibel/Pygalgia/medlever.jad
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Synfuel/Huspil81.asp
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Synfuel/Huspil81.asp
Resource
win10v2004-20240508-en
General
-
Target
Flexibel/Pygalgia/medlever.jad
-
Size
2KB
-
MD5
18260dbf7014af5adc94692ae0d4150c
-
SHA1
ca0b5023c70a3ba59c3892823453ff3c4b1ded2f
-
SHA256
119213bd3c56720d9544d46a09f4b699248c9a0b05a83912374e2ead70f9090b
-
SHA512
e22c39393db9e92ed89c8a55aa04ee1d1601872c24764a3c3483fa166ebac8a07061e76b25add27a87e84de1f6aa0aa454cf7808704bb7a49e7e1147b4987cb0
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad\ = "jad_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2612 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2612 AcroRd32.exe 2612 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2196 2320 cmd.exe 29 PID 2320 wrote to memory of 2196 2320 cmd.exe 29 PID 2320 wrote to memory of 2196 2320 cmd.exe 29 PID 2196 wrote to memory of 2612 2196 rundll32.exe 30 PID 2196 wrote to memory of 2612 2196 rundll32.exe 30 PID 2196 wrote to memory of 2612 2196 rundll32.exe 30 PID 2196 wrote to memory of 2612 2196 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Flexibel\Pygalgia\medlever.jad1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Flexibel\Pygalgia\medlever.jad2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Flexibel\Pygalgia\medlever.jad"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e1b1cf727fbc9f697e249aa3b0f8edac
SHA1ed5a113612ed5b4ee5bac5eef6b27d3271a89121
SHA2560649f541fbe27e89b7cecc2619070455db5729fa4992521543f019f3f18a6aa4
SHA512844df5b8ec1605888d27596df03aa524a6de0e6d22bf38befe1e8f23b18601372d9584f025cd7275867642c8c089499b8f6bd8070e9e2b9b7b2fa97456144f95