Analysis

  • max time kernel
    139s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 02:09 UTC

General

  • Target

    beefa8b66319f9f9e918e9b59f2abd98d5edd82d714f17072894e572ec003e98.exe

  • Size

    76KB

  • MD5

    2533de08d221342961e8f5382fd0357a

  • SHA1

    dabe6e7b5866e9742c08786352817156e80fe7f6

  • SHA256

    beefa8b66319f9f9e918e9b59f2abd98d5edd82d714f17072894e572ec003e98

  • SHA512

    83124312a2102fd3359a5ff46015a488b845cf533909101d82dc16139378da949479d8490ce27524150c73c896c4b5ce2277fcc115883d20b540dc1708357562

  • SSDEEP

    768:Z1zRSL+BoBxN9tpdC7EezJ0d8hPUtrFRtFtg3NojiwvuccA4iiKahtAZchhD6EWr:l3oBdk7ESuqhParNMKnFfiroZchxfSF

Score
8/10

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Creates a Windows Service
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\beefa8b66319f9f9e918e9b59f2abd98d5edd82d714f17072894e572ec003e98.exe
    "C:\Users\Admin\AppData\Local\Temp\beefa8b66319f9f9e918e9b59f2abd98d5edd82d714f17072894e572ec003e98.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\beefa8b66319f9f9e918e9b59f2abd98d5edd82d714f17072894e572ec003e98.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 1
        3⤵
        • Runs ping.exe
        PID:3064
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "SRDSLZ"
    1⤵
      PID:2196
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "SRDSLZ"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\SysWOW64\SRDSLZ.exe
        C:\Windows\system32\SRDSLZ.exe "c:\program files (x86)\259399788.dll",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2648

    Network

      No results found
    • 119.91.152.151:8986
      SRDSLZ.exe
      152 B
      3
    • 119.91.152.151:8986
      SRDSLZ.exe
      152 B
      3
    • 119.91.152.151:8986
      SRDSLZ.exe
      152 B
      3
    • 119.91.152.151:8986
      SRDSLZ.exe
      152 B
      3
    • 119.91.152.151:8986
      SRDSLZ.exe
      152 B
      3
    No results found

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Program Files (x86)\259399788.dll

      Filesize

      33KB

      MD5

      cfe61ee50c917c587a08fd4ac5b61849

      SHA1

      770e76f7cdeea081f7cca0a0ebea7f8231186398

      SHA256

      54077b9108eb2d7c4a539e553fe2071b44698cdb39da6ef59c64025cf1111906

      SHA512

      686aa2a6ddcda9640b1159dd56344601189f1fa78e72866d12902811a3ac67bb6f324d7588ebf6b2b79f6bfe9d92015298c1b0bc8858234027301bf2a0b67ddc

    • \Windows\SysWOW64\SRDSLZ.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.