9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
Size 1.2MB
Sample240613-bxptxsshkn
SHA256 9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e
MD5 ced282825c35f5b6f1636db49a9b0eed
SHA1 ca652bbc91e75329f594ac49dbb5c8ef17b0cf5e
SHA512 f4a694958b202a57d468cc10c92a76e8073593a4ef3ef9cb7b88e2e3666aa6c54189f0466151ebbb1996ad52511f22f60bfc327156dc01ac7a9669b1e78604f6
SSDEEP 24576:sAHnh+eWsN3skA4RV1Hom2KXMmHajufvrl+F6vylagx+Q8M5:Lh+ZkldoPK8Yajufvrllvuf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
2444	name.exe

Loads dropped DLL 1 IoCs

pid	Process
2936	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0008000000015cdf-13.dat	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2444 set thread context of 2620	2444	name.exe	30
PID 2620 set thread context of 1204	2620	svchost.exe	21
PID 2620 set thread context of 2916	2620	svchost.exe	33
PID 2916 set thread context of 1204	2916	recover.exe	21

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	recover.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2620	svchost.exe
2620	svchost.exe
2620	svchost.exe
2620	svchost.exe
2620	svchost.exe
2620	svchost.exe
2620	svchost.exe
2620	svchost.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe
2916	recover.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2444	name.exe
2620	svchost.exe
1204	Explorer.EXE
1204	Explorer.EXE
2916	recover.exe
2916	recover.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2936	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
2936	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
2444	name.exe
2444	name.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2936	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
2936	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
2444	name.exe
2444	name.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2444	2936	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe	29
PID 2936 wrote to memory of 2444	2936	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe	29
PID 2936 wrote to memory of 2444	2936	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe	29
PID 2936 wrote to memory of 2444	2936	9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe	29
PID 2444 wrote to memory of 2620	2444	name.exe	30
PID 2444 wrote to memory of 2620	2444	name.exe	30
PID 2444 wrote to memory of 2620	2444	name.exe	30
PID 2444 wrote to memory of 2620	2444	name.exe	30
PID 2444 wrote to memory of 2620	2444	name.exe	30
PID 1204 wrote to memory of 2916	1204	Explorer.EXE	33
PID 1204 wrote to memory of 2916	1204	Explorer.EXE	33
PID 1204 wrote to memory of 2916	1204	Explorer.EXE	33
PID 1204 wrote to memory of 2916	1204	Explorer.EXE	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe
  "C:\Users\Admin\AppData\Local\Temp\9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Local\directory\name.exe
    "C:\Users\Admin\AppData\Local\Temp\9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2620
- C:\Windows\SysWOW64\recover.exe
  "C:\Windows\SysWOW64\recover.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

polygamodioecious

Path C:\Users\Admin\AppData\Local\Temp\polygamodioecious
Size 28KB
SHA256 6a2e9c1794bb613da9aa59af2848275032b0a15fb342f189dae0313e8c857cab
MD5 f73b9c07c4dbceb2e4a0170a7c8927b5
SHA1 ac29ac1fcc886c66e62c067902d0efc677f53c58
SHA512 812c8b6bbd3e9afe4a1001c3c1c18a4d3c1f6abb2fb2ae173fd2e9b7eedc31c6b258e312090c6f199eebcad9cb2384d7fc4a35de8a4f7f93faca1371be5fe80a
SSDEEP 768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNba+Iitb4vfF3if6gygkr:WiTZ+2QoioGRk6ZklputwjpjBkCiw2R4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ultraradicalism

Path C:\Users\Admin\AppData\Local\Temp\ultraradicalism
Size 265KB
SHA256 45c4cb71b90bdbb261f010786c8e15fba3925ba9501e6c11f05fe9aa5b007183
MD5 b3b4f2970910321f284f5a7801189863
SHA1 d0a53f03383a74b8e760f416c69f914e8bf7eac0
SHA512 4700d83cd40ef0566f74a5038599c78f88661e33fe67b91a18ff9510be0de58e5d155f17fe44439b208740c73265ff7c5ded312fdb0da1257d66fb1b20333a89
SSDEEP 6144:FqLkx6/f0sWqUaKMuWeQO0McQNzAB3v9bClaYwmM:FikMH0NqyJYOTcQNzm3vt
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.exe

Path \Users\Admin\AppData\Local\directory\name.exe
Size 1.2MB
SHA256 9df4b89c75e3a9856566ec02208d5f63f7cc9ab2e216cdd4ea2eac0b12f0e83e
MD5 ced282825c35f5b6f1636db49a9b0eed
SHA1 ca652bbc91e75329f594ac49dbb5c8ef17b0cf5e
SHA512 f4a694958b202a57d468cc10c92a76e8073593a4ef3ef9cb7b88e2e3666aa6c54189f0466151ebbb1996ad52511f22f60bfc327156dc01ac7a9669b1e78604f6
SSDEEP 24576:sAHnh+eWsN3skA4RV1Hom2KXMmHajufvrl+F6vylagx+Q8M5:Lh+ZkldoPK8Yajufvrllvuf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1204-38-0x0000000003BF0000-0x0000000003CF0000-memory.dmp

Download

memory/1204-47-0x0000000009000000-0x00000000095CF000-memory.dmp

Download

memory/1204-39-0x0000000009000000-0x00000000095CF000-memory.dmp

Download

memory/2620-33-0x0000000000790000-0x0000000000A93000-memory.dmp

Download

memory/2620-43-0x0000000000160000-0x000000000017D000-memory.dmp

Download

memory/2620-37-0x0000000000160000-0x000000000017D000-memory.dmp

Download

memory/2620-36-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2620-34-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2620-32-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2620-42-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2620-35-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2916-41-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2916-40-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2916-44-0x00000000024D0000-0x00000000027D3000-memory.dmp

Download

memory/2916-45-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2916-46-0x0000000002200000-0x000000000229C000-memory.dmp

Download

memory/2916-48-0x0000000000080000-0x00000000000BF000-memory.dmp

Download

memory/2936-11-0x0000000000120000-0x0000000000124000-memory.dmp

Download