c2b397d24556912fe908506be9a4ae8c08c2db9217345355f50cc6fce3e01611

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Romper_V5/Romper V5/Romper V5.exe
Size 30.1MB
Sample240609-waxapsdg54
SHA256 cf675be72d39b1ee645b19bdbebbc615d6787d3f1c0e7ca9e2ef7c4396a7764b
MD5 20ccae603d435aab174b7b7e46ac7189
SHA1 c4c34d0a46c2f9532596f6dcb6fb86cc44046ab7
SHA512 69658a3e15a9885691098976b89e8e2dd2936cbc78f0f0d58400dbf98fa14c4e170f9180b1ab130cc796b3a4b4245879e8406860770e03f3223a01d25532beb9
SSDEEP 786432:GW+e569MZLW+e569MuW+e569MgjW+e5i9M:GW+enhW+enuW+engjW+ev
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

pyinstaller

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
2296	COOKD.EXE
2980	CREAL.EXE
848	COOKD.EXE
2800	DISCORD.EXE
2780	PYTHON.EXE
2528	CREAL.EXE
2748	PYTHON.EXE
2872	DISCORD.EXE

Loads dropped DLL 12 IoCs

pid	Process
2868	Romper V5.exe
2868	Romper V5.exe
2296	COOKD.EXE
2868	Romper V5.exe
2868	Romper V5.exe
2980	CREAL.EXE
848	COOKD.EXE
2780	PYTHON.EXE
2800	DISCORD.EXE
2528	CREAL.EXE
2748	PYTHON.EXE
2872	DISCORD.EXE

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral5/files/0x000b00000001267a-2.dat	pyinstaller
behavioral5/files/0x002b000000012721-26.dat	pyinstaller
behavioral5/files/0x0006000000014b18-44.dat	pyinstaller
behavioral5/files/0x0006000000015d20-49.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2296	2868	Romper V5.exe	28
PID 2868 wrote to memory of 2296	2868	Romper V5.exe	28
PID 2868 wrote to memory of 2296	2868	Romper V5.exe	28
PID 2868 wrote to memory of 2296	2868	Romper V5.exe	28
PID 2868 wrote to memory of 2980	2868	Romper V5.exe	30
PID 2868 wrote to memory of 2980	2868	Romper V5.exe	30
PID 2868 wrote to memory of 2980	2868	Romper V5.exe	30
PID 2868 wrote to memory of 2980	2868	Romper V5.exe	30
PID 2296 wrote to memory of 848	2296	COOKD.EXE	32
PID 2296 wrote to memory of 848	2296	COOKD.EXE	32
PID 2296 wrote to memory of 848	2296	COOKD.EXE	32
PID 2868 wrote to memory of 2800	2868	Romper V5.exe	33
PID 2868 wrote to memory of 2800	2868	Romper V5.exe	33
PID 2868 wrote to memory of 2800	2868	Romper V5.exe	33
PID 2868 wrote to memory of 2800	2868	Romper V5.exe	33
PID 2868 wrote to memory of 2780	2868	Romper V5.exe	34
PID 2868 wrote to memory of 2780	2868	Romper V5.exe	34
PID 2868 wrote to memory of 2780	2868	Romper V5.exe	34
PID 2868 wrote to memory of 2780	2868	Romper V5.exe	34
PID 2980 wrote to memory of 2528	2980	CREAL.EXE	37
PID 2980 wrote to memory of 2528	2980	CREAL.EXE	37
PID 2980 wrote to memory of 2528	2980	CREAL.EXE	37
PID 2780 wrote to memory of 2748	2780	PYTHON.EXE	38
PID 2780 wrote to memory of 2748	2780	PYTHON.EXE	38
PID 2780 wrote to memory of 2748	2780	PYTHON.EXE	38
PID 2800 wrote to memory of 2872	2800	DISCORD.EXE	39
PID 2800 wrote to memory of 2872	2800	DISCORD.EXE	39
PID 2800 wrote to memory of 2872	2800	DISCORD.EXE	39

C:\Users\Admin\AppData\Local\Temp\Romper_V5\Romper V5\Romper V5.exe
"C:\Users\Admin\AppData\Local\Temp\Romper_V5\Romper V5\Romper V5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\COOKD.EXE
  "C:\Users\Admin\AppData\Local\Temp\COOKD.EXE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\COOKD.EXE
    "C:\Users\Admin\AppData\Local\Temp\COOKD.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:848
- C:\Users\Admin\AppData\Local\Temp\CREAL.EXE
  "C:\Users\Admin\AppData\Local\Temp\CREAL.EXE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\CREAL.EXE
    "C:\Users\Admin\AppData\Local\Temp\CREAL.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2528
- C:\Users\Admin\AppData\Local\Temp\DISCORD.EXE
  "C:\Users\Admin\AppData\Local\Temp\DISCORD.EXE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\DISCORD.EXE
    "C:\Users\Admin\AppData\Local\Temp\DISCORD.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2872
- C:\Users\Admin\AppData\Local\Temp\PYTHON.EXE
  "C:\Users\Admin\AppData\Local\Temp\PYTHON.EXE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\PYTHON.EXE
    "C:\Users\Admin\AppData\Local\Temp\PYTHON.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CREAL.EXE

Path C:\Users\Admin\AppData\Local\Temp\CREAL.EXE
Size 7.5MB
SHA256 78b6b54a4643d3648f9653cfd9ec89b0d158f586647e7afc1b78113e1b988585
MD5 2dc33067754eb099bd137180a357088b
SHA1 65ec6e077726a462fe96c32f0540891e76cabc4e
SHA512 b0073ba54eebfc0afc1ce8c72d9dc87050e434d77f86d2c3d4cfc00c2d84463cd0ab7891e74eaea92de46c934ff13f61202d4f33d6209e45b4b96e064348d7fa
SSDEEP 196608:JSVV1W903eV4Q+tpDjIIAcwDBRPgjvvk9LIL:6LW+eGQ69joBGWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

DISCORD.EXE

Path C:\Users\Admin\AppData\Local\Temp\DISCORD.EXE
Size 7.4MB
SHA256 c11cf38be5e32cf2f7172a47dd93bff04168b4f607a26558d84b90783ba67372
MD5 3cc78ec13e19e7deacb003b556afa189
SHA1 26f4ce646c930464b07c3eb8d7f888354df0f73b
SHA512 23bd312a390f7779085732a648026bb06f215ebde483dd1b824b53be03382173b0626be5683860c0c3b806dd081677165b99305ff8990c086231f818f03828b8
SSDEEP 196608:jvp1W903eV4Q+tpDjIIAcwDBRPgjvvk9LIL:rW+eGQ69joBGWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

PYTHON.EXE

Path C:\Users\Admin\AppData\Local\Temp\PYTHON.EXE
Size 7.3MB
SHA256 aabbc779eef339c207509e4ca1ab3cf82abe780c3a5c2cecf39cb3730de5cf61
MD5 ac69ea4dae2d61194cedc40f423fc240
SHA1 9ec71b517b7e7c36091dbf96fb8eb0577cf0b7f2
SHA512 0c224aeccc66a19bc2ab2911c70a7b2a6bbd5c4cc8f57c3001c7e1f6dfb5c2aa310b73e669592a9c3f244d352bff37f5c912ed37a4e860a62ef1a508de1acc8b
SSDEEP 196608:7Y5A+1W903eV4Q2tpDjIIAcwD0RPTv/k9DpIL:UjW+eGQi9jo0oO
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22962\python312.dll
Size 6.6MB
SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
MD5 5c5602cda7ab8418420f223366fff5db
SHA1 52f81ee0aef9b6906f7751fd2bbd4953e3f3b798
SHA512 51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f
SSDEEP 98304:B6vwRS7fYzmSSVlLWyJVT7OQvxHDMiEPlk:8vwRHTSVlfJVmir
MD5 SHA1 SHA512 SSDEEP

Submit Download

COOKD.EXE

Path \Users\Admin\AppData\Local\Temp\COOKD.EXE
Size 7.5MB
SHA256 13611a82912fc262cec5433aeb83c62e6488c5931359749c8a29dcc3bc66c731
MD5 a4d88d60fdebe4d85736d7684de377d5
SHA1 3cd96116e5ee43b28a499ea48eff1533b029d8be
SHA512 739223bae82b42c55bdabc0e7d94d0f9daf4b130317122a491ad36e34da0f3a6ba30e87ef0aeba4319aded8a156f31ffdbcb803921f208c7e00ea7ee11e144b5
SSDEEP 196608:ODbtG1W903eV4Q+tpDjIIAcwDBRPgjvvk9LIL:ytsW+eGQ69joBGWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads