Malware Analysis Report

2025-01-17 22:38

Sample ID 240603-pw13fsgb33
Target 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac
SHA256 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac

Threat Level: Shows suspicious behavior

The file 8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac was found to be: Shows suspicious behavior.

Malicious Activity Summary


Loads dropped DLL

Drops file in Windows directory

Unsigned PE

Runs ping.exe

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 12:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 12:41

Reported

2024-06-03 12:44

Platform

win7-20240419-en

Max time kernel

142s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Fonts\font_temp.ttf C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe N/A
File opened for modification C:\Windows\Fonts\font_temp.ttf C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1732 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe C:\Windows\SysWOW64\cmd.exe
PID 1732 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe C:\Windows\SysWOW64\cmd.exe
PID 1732 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe C:\Windows\SysWOW64\cmd.exe
PID 1732 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2656 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2656 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2656 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2656 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
PID 2656 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
PID 2656 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
PID 2656 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
PID 2656 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
PID 2656 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe
PID 2656 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe

"C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Restart.bat

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 2

C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe

"C:\Users\Admin\AppData\Local\Temp\8B0634~1.EXE"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230725.lib

MD5 a081782e61d769dcd299bb7672aed743
SHA1 78d4795bb43ad2b949192b09987b17eba156dced
SHA256 34ece32d4bf3dab02772326afd2e5d8d1f28d7c5be6379c3d40875a03345bafa
SHA512 e7384eab27e866284071709f90097db8a6bc630d5dee8b102a0f4a6b9af9a70797209bd50d00ed28899ee4628b937f44cf2eb8d5518562b3c37925ad53704ab0

\Users\Admin\AppData\Local\Temp\f7608d7.tmp

MD5 56a2bcecbd3cddd6f4a35361bf4920d6
SHA1 992e63be423f0e61093ba183f49fc0cbec790488
SHA256 5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab
SHA512 473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551

C:\Users\Admin\AppData\Local\Temp\font_temp.ttf

MD5 092a99ee52bbaef7481cc96c5b85b992
SHA1 06b8475f99605af9ff9ff3ed1d0eb907fd57c06b
SHA256 b3f675ccfc65edd6f27432dec6639b1414e9dc627831791263a99e2d711d215d
SHA512 3538cebe1c0e2439c7ba289c4420627d59b4922e26242408f114aa01d342734b057d92edac35bee7c47cb926091695efc6c560802db0cd342f75cee1f8b96baf

C:\Users\Admin\AppData\Local\Temp\Restart.bat

MD5 978d3afcd430e12574940784a306a930
SHA1 476b59fa345bf72049c53e7b9c0766d6cd6e30c0
SHA256 ca9869f8c04e523c71b628ca941151ef51428985506fd47130dddf859fde2220
SHA512 970212ea574c05a7db2e622a3d5a1929dd7d2006d7e1fc780c9428372b2b9b58f851f4082bf3a9d0727bb72b92abcdb9aded071dd42ad2aecb2fd15fb7d59512

memory/3048-35-0x0000000061080000-0x0000000061119000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 12:41

Reported

2024-06-03 12:44

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe"

Signatures

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Fonts\font_temp.ttf C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe N/A
File opened for modification C:\Windows\Fonts\font_temp.ttf C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe

"C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Restart.bat

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 2

C:\Users\Admin\AppData\Local\Temp\8b0634456c51cdb5b026c329338a84eaf9bff1cdcefa4db0566f9aefd76b1cac.exe

"C:\Users\Admin\AppData\Local\Temp\8B0634~1.EXE"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230725.lib

MD5 a081782e61d769dcd299bb7672aed743
SHA1 78d4795bb43ad2b949192b09987b17eba156dced
SHA256 34ece32d4bf3dab02772326afd2e5d8d1f28d7c5be6379c3d40875a03345bafa
SHA512 e7384eab27e866284071709f90097db8a6bc630d5dee8b102a0f4a6b9af9a70797209bd50d00ed28899ee4628b937f44cf2eb8d5518562b3c37925ad53704ab0

C:\Users\Admin\AppData\Local\Temp\e57e4b3.tmp

MD5 56a2bcecbd3cddd6f4a35361bf4920d6
SHA1 992e63be423f0e61093ba183f49fc0cbec790488
SHA256 5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab
SHA512 473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551

C:\Users\Admin\AppData\Local\Temp\font_temp.ttf

MD5 092a99ee52bbaef7481cc96c5b85b992
SHA1 06b8475f99605af9ff9ff3ed1d0eb907fd57c06b
SHA256 b3f675ccfc65edd6f27432dec6639b1414e9dc627831791263a99e2d711d215d
SHA512 3538cebe1c0e2439c7ba289c4420627d59b4922e26242408f114aa01d342734b057d92edac35bee7c47cb926091695efc6c560802db0cd342f75cee1f8b96baf

C:\Users\Admin\AppData\Local\Temp\Restart.bat

MD5 978d3afcd430e12574940784a306a930
SHA1 476b59fa345bf72049c53e7b9c0766d6cd6e30c0
SHA256 ca9869f8c04e523c71b628ca941151ef51428985506fd47130dddf859fde2220
SHA512 970212ea574c05a7db2e622a3d5a1929dd7d2006d7e1fc780c9428372b2b9b58f851f4082bf3a9d0727bb72b92abcdb9aded071dd42ad2aecb2fd15fb7d59512

memory/732-35-0x0000000061080000-0x0000000061119000-memory.dmp