Analysis
-
max time kernel
361s -
max time network
362s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 17:10
Behavioral task
behavioral1
Sample
L3AK.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
L3AK.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
keylogger.pyc
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
keylogger.pyc
Resource
win10v2004-20240426-en
General
-
Target
keylogger.pyc
-
Size
3KB
-
MD5
73e081c55443aa4ce30a2bf083444759
-
SHA1
38be1c14d2086f1373030baa399338d1a5948a67
-
SHA256
1f7571aae5837ad1989679c9095c5f48fc3682bba11c74c80993baf351ce82cc
-
SHA512
6a333c322184df96af103b0769ef7ec6e389f077331a7a6edb97845b93047707da67a7730dbc869fc3b3980440b72341acb2ec1ee85d44029daed520bb342030
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 12 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\edit\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\open\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\edit rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2720 NOTEPAD.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 2816 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2080 wrote to memory of 2816 2080 cmd.exe rundll32.exe PID 2080 wrote to memory of 2816 2080 cmd.exe rundll32.exe PID 2080 wrote to memory of 2816 2080 cmd.exe rundll32.exe PID 2816 wrote to memory of 2720 2816 rundll32.exe NOTEPAD.EXE PID 2816 wrote to memory of 2720 2816 rundll32.exe NOTEPAD.EXE PID 2816 wrote to memory of 2720 2816 rundll32.exe NOTEPAD.EXE
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\keylogger.pyc1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\keylogger.pyc2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\keylogger.pyc3⤵
- Opens file in notepad (likely ransom note)