64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe
Size

69KB
MD5

68fd78ad06e1b8b68cdaed4bfd363c23
SHA1

6ebd7a43eb65890bb1d06565c3b1a01d6b32be1f
SHA256

64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89
SHA512

fb130ced6b13a8b7444399d48a2f92461a3358152156be346b4e464e826faccd0e7ea2eec99b7fea7be06b4e06bb69d94d543dad5053dbb2b3a3c99ee4845254
SSDEEP

1536:BXV/aCw5cg+3hK0000000000000cXPrnz6UJJbJeJqgJ4wtRMHynvjcUt:VNaKxu7z/bJeJqgJ4wzMSnvjcK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2796	hurok.exe

Loads dropped DLL 2 IoCs

pid	Process
1424	64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe
1424	64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1424	64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe
2796	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2796	1424	64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe	28
PID 1424 wrote to memory of 2796	1424	64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe	28
PID 1424 wrote to memory of 2796	1424	64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe	28
PID 1424 wrote to memory of 2796	1424	64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe	28

C:\Users\Admin\AppData\Local\Temp\64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe
"C:\Users\Admin\AppData\Local\Temp\64c9eacc75f933b2a40fbc76d8599128a858aad530df765323b8530ae87b4c89.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
69KB

MD5
ad9dc2b2e8c62f319a0ab1c1b6e34347

SHA1
730bc8c26345d62787aa970cab4cb4c9f241584a

SHA256
b244e3c96547c7215da3a1f30e23096e19dec3ddcee4848c357029b344553ca8

SHA512
61e703a5168fbe0b04971d5973d432a51a4e7f57ec4e96a0ae3d5fbebbc609d0eae1ad39d9e6213f3256166e5fe7b387680e8e7e66bfdecf6fa9d522188ad936

Download Submit
memory/1424-0-0x00000000000F0000-0x00000000000F6000-memory.dmp

Filesize
24KB

Download
memory/1424-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1424-7-0x00000000000F0000-0x00000000000F6000-memory.dmp

Filesize
24KB

Download
memory/2796-25-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download