Overview
overview
7Static
static
3Xfer_KeyGen.exe
windows7-x64
7Xfer_KeyGen.exe
windows10-2004-x64
7$TEMP/BASSMOD.dll
windows7-x64
1$TEMP/BASSMOD.dll
windows10-2004-x64
1$TEMP/R2RXFEKG.dll
windows7-x64
1$TEMP/R2RXFEKG.dll
windows10-2004-x64
3$TEMP/keygen.exe
windows7-x64
1$TEMP/keygen.exe
windows10-2004-x64
1Analysis
-
max time kernel
61s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:32
Static task
static1
Behavioral task
behavioral1
Sample
Xfer_KeyGen.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Xfer_KeyGen.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$TEMP/BASSMOD.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$TEMP/BASSMOD.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$TEMP/R2RXFEKG.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$TEMP/R2RXFEKG.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
$TEMP/keygen.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$TEMP/keygen.exe
Resource
win10v2004-20240508-en
General
-
Target
Xfer_KeyGen.exe
-
Size
559KB
-
MD5
3502197687f3356bc50ab03329831d22
-
SHA1
a6ad8b22a2a45eda34c64d33e55236e3d3cf440e
-
SHA256
29e65b74b8ffaedfc0fc4e233684c89eaa4a2f36c4fe478a3d851991b32e5950
-
SHA512
adffec8a1940113c1a7545a8778fc77db1f9bf6f0a4f216f96bef5ea9197831e3821d4f5b822e08fcc15477a3650ab60dd88814008b85db56b27f5c624c0eb7d
-
SSDEEP
12288:XYkc9t2Sll/Sq9x4oWrSfzTw9wViWOfo1l9ds/7NPq7:XYkcL5Sq/4jurIGOfobvkNPq7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
keygen.exepid process 1224 keygen.exe -
Loads dropped DLL 4 IoCs
Processes:
Xfer_KeyGen.exekeygen.exepid process 2192 Xfer_KeyGen.exe 2192 Xfer_KeyGen.exe 1224 keygen.exe 1224 keygen.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Xfer_KeyGen.exedescription pid process target process PID 2192 wrote to memory of 1224 2192 Xfer_KeyGen.exe keygen.exe PID 2192 wrote to memory of 1224 2192 Xfer_KeyGen.exe keygen.exe PID 2192 wrote to memory of 1224 2192 Xfer_KeyGen.exe keygen.exe PID 2192 wrote to memory of 1224 2192 Xfer_KeyGen.exe keygen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xfer_KeyGen.exe"C:\Users\Admin\AppData\Local\Temp\Xfer_KeyGen.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\keygen.exeC:\Users\Admin\AppData\Local\Temp\keygen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLLFilesize
33KB
MD5e4ec57e8508c5c4040383ebe6d367928
SHA1b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA2568ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA51277d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
-
C:\Users\Admin\AppData\Local\Temp\R2RXFEKG.dllFilesize
3KB
MD5fb235a312dbde4daf45aa6d62923d2c4
SHA167580595f059640b974cd585b3deac25aba5928e
SHA256fb2ef28d03f1bbc60cb564cc8d90b3469f3ad393d81020b4afe2501c1b60da9c
SHA51214c7ba743221520753266119b4f91023321fdead7e3f941e4c6ede1b439886fcdfe7565eefd00d03f7c93686234ccd7369e150f2ad344d365ed0447c6aa6f898
-
C:\Users\Admin\AppData\Local\Temp\bgm.modFilesize
459KB
MD527bb415f94ed6f7bbbe60147e256d806
SHA1311558f88abe5095c46641368982f1effc8dabc5
SHA25609eb0d54924d998add82d73ba86350ac09c1f5714d895e08c77f34441da1c2c3
SHA512161dbae65d5ef4f2bbb4c57fa18c72b3c2b2a5993bc763d673832899eaa3d120697d4192362d2270e0d9630b0dc9429b3e221bb44cf0ff59de46e949d2a4cc70
-
\Users\Admin\AppData\Local\Temp\keygen.exeFilesize
249KB
MD539940bef79a1d23adf86979d4d4cceed
SHA1593f9ea0cd0c1c4ec35c92a4473ed05437fb22ce
SHA256941267a1bd1328f21bbaf3a1ba5abe12196c3d57e4c49134c6764e7b143767d8
SHA51212b8f61bb8c1c661d7d4c7aff5e2e3f2915cd1b3c923bf9b17dd3bcc8b3ffb4145aa86b284bedd2695c6e62117cc1257a896dfe3227961deac35e8e9836d12c3
-
memory/1224-19-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/1224-17-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/1224-11-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/1224-20-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/1224-21-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/1224-22-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/1224-23-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/1224-24-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/1224-25-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB