861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26

Analysis

max time kernel
148s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe
Size

408KB
MD5

209f3f1fde4077051c1b4a3049676413
SHA1

20fcfcc0e44c6f8def6db540fe109773d140bcb7
SHA256

861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26
SHA512

0c31af526e3975381d4dbbebf8e30400e5fde3bdf41268da6db0f8c0b376280fa4d057b51f2802ecfe458d0e3d79c240703b5948b6bef0eefc639f0e3a5120f0
SSDEEP

12288:4jauDReWHjpeM4ujEW8uqnjtPskA1Q1vUP25J7w4QmsPzL:4DDDjpe696njtUkA1vP25J7w4QmsPzL

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

vesvor.exe

pid process

2372 vesvor.exe

pid	process
2372	vesvor.exe

Loads dropped DLL 2 IoCs

Processes:

861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe

pid	process
1720	861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe
1720	861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vesvor.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\vesvor.exe"	vesvor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe

description	pid	process	target process
PID 1720 wrote to memory of 2372	1720	861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe	vesvor.exe
PID 1720 wrote to memory of 2372	1720	861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe	vesvor.exe
PID 1720 wrote to memory of 2372	1720	861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe	vesvor.exe
PID 1720 wrote to memory of 2372	1720	861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe	vesvor.exe

C:\Users\Admin\AppData\Local\Temp\861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe
"C:\Users\Admin\AppData\Local\Temp\861bea15084d958c41721284bf4f463fa812fce526ee9400d169ad222d0e4c26.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720

C:\ProgramData\vesvor.exe
"C:\ProgramData\vesvor.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2372

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache .exe
Filesize
408KB

MD5
a581feafcdfb5bb5f6f00ea809bc5444

SHA1
67f5a1b8729e5ef7e5803ef86c9093e24096c352

SHA256
d2f4aa1c999fb68a52291fe7134f9de8896c5989cd22c95041617717b7c6243e

SHA512
c31238cc05a8159712596df7b5487b5a3fd102f0ccc5f732e2d0d8f6e07b53594892aac1ee4946836aa6c3a9160f89ceb9d7f178535be75f603382df0b4506cb

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
\ProgramData\vesvor.exe
Filesize
271KB

MD5
38173a3b498b607cab231e5b3f431aa4

SHA1
f8f24269ea20b909d3b45ac8299a99c8ae2e2d6a

SHA256
658039d9d1e9bd6023b439e83956395da5f4dea705045b1eb1d9e3e2bd671420

SHA512
771dc78b4e62a88641c7b7fa9398a7e6375f76ddfb4f3b6e699b379ea184bb288f0923e0dad86a8e74be551c76f037a9897c5cbb2f45138030665eb15a108561

Download Submit
memory/1720-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1720-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1720-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2372-131-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads