98b52813707d4293c6150cd7e602240ad1ca266807c3c7225f2a3dbf6de7a13d

Resubmissions

23-05-2024 01:46

240523-b7cmcahd57 3

23-05-2024 01:42

240523-b45hyshc65 3

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MerekV3.08 Lite/Merek Aimbot/__pycache__/keyauth.cpython-310.pyc
Size

19KB
MD5

03913d5dcd09637c06deba35d3cf8ab6
SHA1

3c49ea419bcd02e50a5102e60387d09a079b7d57
SHA256

f97e0981bbfec62065e9101300ab345f2389c6b94606a2ea655b8c38e11aa575
SHA512

8be7da1ba56dd7b2e62e7f4db6d96fa0ac04bcddb231c36a79d3cdf55a5af5f5808b1604ee5552943665cb39298fc1f9c163f796284c8268606a8782f688a8ba
SSDEEP

384:8PZGJybYD3edL4xzhmp2Ugcem86Rv+dxbpqYSLDYmG0iLnOVy:qjNk7mp2GeX6RvKbpqYSAmH0nCy

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

2600 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

1296 AcroRd32.exe
1296 AcroRd32.exe

pid	process
2600	rundll32.exe

pid	process
1296	AcroRd32.exe
1296	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2360 wrote to memory of 2600	2360	cmd.exe	rundll32.exe
PID 2360 wrote to memory of 2600	2360	cmd.exe	rundll32.exe
PID 2360 wrote to memory of 2600	2360	cmd.exe	rundll32.exe
PID 2600 wrote to memory of 1296	2600	rundll32.exe	AcroRd32.exe
PID 2600 wrote to memory of 1296	2600	rundll32.exe	AcroRd32.exe
PID 2600 wrote to memory of 1296	2600	rundll32.exe	AcroRd32.exe
PID 2600 wrote to memory of 1296	2600	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\__pycache__\keyauth.cpython-310.pyc"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\__pycache__\keyauth.cpython-310.pyc
2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2600

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\__pycache__\keyauth.cpython-310.pyc"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1296

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
f763c0048216373b33c4596fe597ea7c

SHA1
901b525fcc3d22deceed6efd11a5f69d419ba96b

SHA256
4981e34079f66ff2554629eb2d8c4415d76f098c739f7e58b72583edefd85571

SHA512
4c2ce99487f7965b066e4b5834f775263796febbf27c9fb73837d755f21998f5d7d561da3c362973024907d2780419a1571cf6a5f6bba17b36f79ad15d34d024

Download Submit