Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 01:17
Static task
static1
Behavioral task
behavioral1
Sample
holf.exe
Resource
win7-20231129-en
General
-
Target
holf.exe
-
Size
884KB
-
MD5
912d6c88f475bb275629201d52ae0ae6
-
SHA1
3e64f86e98787997c98b98039bb491fa613e79cc
-
SHA256
6b8e10fb6b6aa647c8c0ba181184d950e9f47ca6753213fc96b1b3ec18409f93
-
SHA512
c8362c522e556166cc018800f721c8c4c3067d51209063f91424fbaf249b36441fc69e2556ee9b94cb7c0a6eee82d51b6105c3fa1a8148a98446e1a7e368d254
-
SSDEEP
24576:rmoO8itEqfZng7cw8lSQzuQM9saXICbmyX97i:qvZScwKSQzrM9ZzfN7i
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
holf.exeexcel.sfx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation holf.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation excel.sfx.exe -
Executes dropped EXE 2 IoCs
Processes:
excel.sfx.exeexcel.exepid process 2032 excel.sfx.exe 1796 excel.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
excel.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files\\DDP Host\\ddphost.exe" excel.exe -
Processes:
excel.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA excel.exe -
Drops file in Program Files directory 2 IoCs
Processes:
excel.exedescription ioc process File created C:\Program Files\DDP Host\ddphost.exe excel.exe File opened for modification C:\Program Files\DDP Host\ddphost.exe excel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
excel.exepid process 1796 excel.exe 1796 excel.exe 1796 excel.exe 1796 excel.exe 1796 excel.exe 1796 excel.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
excel.exepid process 1796 excel.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
excel.exedescription pid process Token: SeDebugPrivilege 1796 excel.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
holf.execmd.exeexcel.sfx.exedescription pid process target process PID 1300 wrote to memory of 3208 1300 holf.exe cmd.exe PID 1300 wrote to memory of 3208 1300 holf.exe cmd.exe PID 1300 wrote to memory of 3208 1300 holf.exe cmd.exe PID 3208 wrote to memory of 2032 3208 cmd.exe excel.sfx.exe PID 3208 wrote to memory of 2032 3208 cmd.exe excel.sfx.exe PID 3208 wrote to memory of 2032 3208 cmd.exe excel.sfx.exe PID 2032 wrote to memory of 1796 2032 excel.sfx.exe excel.exe PID 2032 wrote to memory of 1796 2032 excel.sfx.exe excel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\holf.exe"C:\Users\Admin\AppData\Local\Temp\holf.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\fdd.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\excel.sfx.exeexcel.sfx.exe -p126 -dC:\Users\Admin\AppData\Local\Temp3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\excel.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\excel.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\excel.sfx.exeFilesize
757KB
MD5a0b5f08cd959d1e068179e1d6889710f
SHA1e26ac168101697f1660990cfacbad48da4225e04
SHA256e9b5abcd2b8ea76a1e8632156689bd234ddfb0b5be2674b72a17be5b62dcebe2
SHA5127dad1ac11f01c2ed7982f79e891a5b7f07daf6ec126a7a04e0b67681ec08c136f260bdf88e71e319a7285efb4c5fec902c00d5801e7b606e7334c2d4ac5b7aa9
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\fdd.batFilesize
28B
MD5f0b6f875f327f542118e2416f8259a13
SHA13edb59643d2be4f440aa9216c1a4ec52a972b8de
SHA25648b03ca255d2246d388cce7df6cf578303485d5acfe53e9ca7038ff518a3be01
SHA512f3a0191c5d34fa0771e6ad053a046a3b3d0cec5f61a82281bffe309258d74599534afbd814bb397b619e6033e59b2dc372112cbbcb92cb6ecfd74ce4481bb2ad
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\excel.exeFilesize
552KB
MD53a8ea73b34b33345474770c83cc825ae
SHA1d50ce020098b23149d354ee1c4e6ed742ace11fd
SHA2562b0196abbdb448cdde45f9bc9bce3c879f39ff3783ce375a7a6a1ce4130025f1
SHA5129cbdb8c16fb4595c44434351ae4df8bbbb137dce51e041df8fdbfee031a199d040e6385ea8b93421908b46799a52fbda660ff08f457f536bd511957c5a22b145
-
memory/1796-32-0x000000001CF80000-0x000000001CF8E000-memory.dmpFilesize
56KB
-
memory/1796-30-0x000000001C7C0000-0x000000001C7D2000-memory.dmpFilesize
72KB
-
memory/1796-21-0x000000001C340000-0x000000001C3DC000-memory.dmpFilesize
624KB
-
memory/1796-22-0x000000001C590000-0x000000001C636000-memory.dmpFilesize
664KB
-
memory/1796-23-0x00000000013E0000-0x00000000013E8000-memory.dmpFilesize
32KB
-
memory/1796-26-0x000000001C8E0000-0x000000001C8EA000-memory.dmpFilesize
40KB
-
memory/1796-27-0x000000001C7B0000-0x000000001C7C2000-memory.dmpFilesize
72KB
-
memory/1796-28-0x000000001CF50000-0x000000001CF6A000-memory.dmpFilesize
104KB
-
memory/1796-29-0x000000001C680000-0x000000001C68E000-memory.dmpFilesize
56KB
-
memory/1796-19-0x0000000001410000-0x0000000001420000-memory.dmpFilesize
64KB
-
memory/1796-31-0x000000001C860000-0x000000001C86C000-memory.dmpFilesize
48KB
-
memory/1796-20-0x000000001BE70000-0x000000001C33E000-memory.dmpFilesize
4.8MB
-
memory/1796-33-0x000000001CF90000-0x000000001CFA4000-memory.dmpFilesize
80KB
-
memory/1796-34-0x0000000001400000-0x0000000001410000-memory.dmpFilesize
64KB
-
memory/1796-36-0x000000001C870000-0x000000001C87E000-memory.dmpFilesize
56KB
-
memory/1796-37-0x000000001CFA0000-0x000000001CFBE000-memory.dmpFilesize
120KB
-
memory/1796-35-0x000000001C6A0000-0x000000001C6B4000-memory.dmpFilesize
80KB
-
memory/1796-38-0x000000001CF70000-0x000000001CF7A000-memory.dmpFilesize
40KB
-
memory/1796-40-0x000000001D130000-0x000000001D144000-memory.dmpFilesize
80KB
-
memory/1796-39-0x000000001D100000-0x000000001D12E000-memory.dmpFilesize
184KB
-
memory/1796-41-0x0000000001410000-0x0000000001420000-memory.dmpFilesize
64KB