Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 03:53
Static task
static1
Behavioral task
behavioral1
Sample
f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe
Resource
win7-20231129-en
General
-
Target
f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe
-
Size
93KB
-
MD5
3e2d1f232c5a6ba7c01b891716e9c4bb
-
SHA1
61d535cce9c81f45a1ef54e9323fc3be2fa899e3
-
SHA256
f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb
-
SHA512
0c7e3e619d1a4b8bd29bafbf885a2428efabb73c072dddae86c9463b80699380b4febfa8e007f3f6f48cba3db63ac2b6064c1a6f3c4e2402ffa0fbf5c6e1b05a
-
SSDEEP
768:54pt1NSf7M9Syk+IAnTjwm41tYhZV6pudcMiDh7FOaRb8RC1J3AFLT7Dm3UIn4U+:OVNSf7hyk+I6412V6PMqAax80XAFSrRo
Malware Config
Extracted
urelas
218.54.47.77
218.54.47.74
Signatures
-
Detects executables built or packed with MPress PE compressor 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1168-0-0x0000000000400000-0x0000000000438000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Users\Admin\AppData\Local\Temp\huter.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/1168-16-0x0000000000400000-0x0000000000438000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2600-19-0x0000000000400000-0x0000000000438000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2600-21-0x0000000000400000-0x0000000000438000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/2600-28-0x0000000000400000-0x0000000000438000-memory.dmp INDICATOR_EXE_Packed_MPress -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe -
Executes dropped EXE 1 IoCs
Processes:
huter.exepid process 2600 huter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exedescription pid process target process PID 1168 wrote to memory of 2600 1168 f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe huter.exe PID 1168 wrote to memory of 2600 1168 f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe huter.exe PID 1168 wrote to memory of 2600 1168 f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe huter.exe PID 1168 wrote to memory of 3600 1168 f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe cmd.exe PID 1168 wrote to memory of 3600 1168 f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe cmd.exe PID 1168 wrote to memory of 3600 1168 f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe"C:\Users\Admin\AppData\Local\Temp\f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵PID:3600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\golfinfo.iniFilesize
512B
MD5d8c69e006046149f40585fb3e1bfafb4
SHA197073fb1d116248dbecd009e4bf873ab45c6c2da
SHA256df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228
SHA512b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9
-
C:\Users\Admin\AppData\Local\Temp\huter.exeFilesize
93KB
MD53e2d1f232c5a6ba7c01b891716e9c4bb
SHA161d535cce9c81f45a1ef54e9323fc3be2fa899e3
SHA256f03535ae3becd1dd0b531f945b5667579a3a28ed97c779c83c480118bb6f0abb
SHA5120c7e3e619d1a4b8bd29bafbf885a2428efabb73c072dddae86c9463b80699380b4febfa8e007f3f6f48cba3db63ac2b6064c1a6f3c4e2402ffa0fbf5c6e1b05a
-
C:\Users\Admin\AppData\Local\Temp\sanfdr.batFilesize
338B
MD52e78d15e9c44326c0c9ff68313c97456
SHA1e9663f3f5b08ca87e7a6a8eef59cdc04a5141768
SHA25637188f5d58697e6cac205245ecf986066e280842e0b599eae718eb47c9f1d5d9
SHA512ad077a0a64ca9f1528bd4ce26f9db91424a3f29a5f398edbd4655565d501392d0531e1c33de23e416cfa7216092bb081c91f62a75f6e9a25f6696bea270ac19b
-
memory/1168-0-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1168-16-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2600-19-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2600-21-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2600-28-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB