Resubmissions

23-05-2024 01:46

240523-b7cmcahd57 3

23-05-2024 01:42

240523-b45hyshc65 3

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    23-05-2024 01:42

General

  • Target

    MerekV3.08 Lite/Merek Aimbot/pyarmor_runtime_000000/__init__.py

  • Size

    103B

  • MD5

    e45322bb879c8ca2c6dcac9d8c66ab87

  • SHA1

    4e26a2b067cbae277fc25459aed46817c794a259

  • SHA256

    17253fb13b525a9a8e05dfea22b5f3e9e8ea940c064d5a4e0bfaa4be5185e849

  • SHA512

    8051237cf4b7b5251c7f10d31235aaf0530ba2a185dba1e98c71b9b893d69799bf3a306eb87fe7deca9574d0b10dcde3e911e0c4351b6225509d95261a06dabd

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\pyarmor_runtime_000000\__init__.py"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\pyarmor_runtime_000000\__init__.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\pyarmor_runtime_000000\__init__.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    9ecea742306eace6440a7714875eb99b

    SHA1

    1003eb88c9c84b054f8a6d0974b38a7fc6d302b2

    SHA256

    b8733abaa4b20df8146857616d71e4931becd3b40b6bc7dc5a756a2392960858

    SHA512

    d49ace5f0a43f81d80f03df555d7e3f9c8a5eb21b630e145cf8850e8ab2ab1cbe25d4e7232d2cb687d1ae3e2fb1de4640e5691e0d4fcc55221407afa2a0bff11