Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows7-x64
100di3x.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
72c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows7-x64
8Archive.zi...3e.exe
windows10-2004-x64
8[email protected]
windows7-x64
4[email protected]
windows10-2004-x64
4[email protected]
windows7-x64
1[email protected]
windows10-2004-x64
1Resubmissions
03-07-2024 22:59
240703-2yn7wszhlp 1003-07-2024 16:13
240703-tn93lsyglf 1003-07-2024 16:11
240703-tm84xsyfma 1010-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 10Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 16:25
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
0di3x.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
0di3x.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
31.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
31.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20240426-en
General
-
Target
-
Size
495KB
-
MD5
181ee63003e5c3ec8c378030286ed7a2
-
SHA1
6707f3a0906ab6d201edc5b6389f9e66e345f174
-
SHA256
55bfcb784904477ef62ef7e4994dee42f03d69bfec3591989513cccbba3fc8fe
-
SHA512
e9820f60b496d6631e054204c6fc5b525527d40a578faac1d5cdb116abcb4a35aacf4f4354ff092a2b455c5d9c2e0f29a761d737d9c9ad3d59d70b51d0583d92
-
SSDEEP
12288:ehny10sOqEl5yD4UmxYV1g1bT2kdSOSGL84Umxb:exZ5vYORMOJ/b
Malware Config
Signatures
-
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\File Cache\DLL.dll [email protected] File created C:\Windows\File Cache\IFEO.exe [email protected] File created C:\Windows\File Cache\Driver.sys [email protected] -
Program crash 1 IoCs
pid pid_target Process procid_target 2596 1896 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1896 [email protected] -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1896 [email protected] -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1896 wrote to memory of 2596 1896 [email protected] 28 PID 1896 wrote to memory of 2596 1896 [email protected] 28 PID 1896 wrote to memory of 2596 1896 [email protected] 28 PID 1896 wrote to memory of 2596 1896 [email protected] 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 6242⤵
- Program crash
PID:2596
-