Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 02:00
Static task
static1
Behavioral task
behavioral1
Sample
lNV-9088759885958.cmd
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
lNV-9088759885958.cmd
Resource
win10v2004-20240611-en
General
-
Target
lNV-9088759885958.cmd
-
Size
4.1MB
-
MD5
75a6cb4a92d02ef6c1bf0e5088190cb9
-
SHA1
e99ebb72703971edc6e73f50b03b833fbbe0dde7
-
SHA256
5c65588d938a6d29b783795576286474107a7989112326cccbecdbdc433f41f3
-
SHA512
298ec5450835768029318bfb045de38b501eeb41c74e98d4c569da38ca2768fe026b9febc968508857fc9bfcdd3ac6cb4d8c640cdc2631d989e865bc4a2b2af2
-
SSDEEP
49152:50zbEfxlWCpt6Tz5d1ej30RxqEc0Z6oJYLmNfLIewZTJN6666Iuq66fKID6+6I6h:r
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.exepid process 2344 alpha.exe 2148 alpha.exe 2664 kn.exe 2724 alpha.exe 2748 kn.exe 2668 Audio.pif 2784 alpha.exe 2528 alpha.exe -
Loads dropped DLL 7 IoCs
Processes:
cmd.exealpha.exealpha.exepid process 1640 cmd.exe 1640 cmd.exe 2148 alpha.exe 1640 cmd.exe 2724 alpha.exe 1640 cmd.exe 1640 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 4 drive.google.com 5 drive.google.com 6 drive.google.com 2 drive.google.com -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
Audio.pifpid process 2668 Audio.pif -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exedescription pid process target process PID 1640 wrote to memory of 2600 1640 cmd.exe extrac32.exe PID 1640 wrote to memory of 2600 1640 cmd.exe extrac32.exe PID 1640 wrote to memory of 2600 1640 cmd.exe extrac32.exe PID 1640 wrote to memory of 2344 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2344 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2344 1640 cmd.exe alpha.exe PID 2344 wrote to memory of 2804 2344 alpha.exe extrac32.exe PID 2344 wrote to memory of 2804 2344 alpha.exe extrac32.exe PID 2344 wrote to memory of 2804 2344 alpha.exe extrac32.exe PID 1640 wrote to memory of 2148 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2148 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2148 1640 cmd.exe alpha.exe PID 2148 wrote to memory of 2664 2148 alpha.exe kn.exe PID 2148 wrote to memory of 2664 2148 alpha.exe kn.exe PID 2148 wrote to memory of 2664 2148 alpha.exe kn.exe PID 1640 wrote to memory of 2724 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2724 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2724 1640 cmd.exe alpha.exe PID 2724 wrote to memory of 2748 2724 alpha.exe kn.exe PID 2724 wrote to memory of 2748 2724 alpha.exe kn.exe PID 2724 wrote to memory of 2748 2724 alpha.exe kn.exe PID 1640 wrote to memory of 2668 1640 cmd.exe Audio.pif PID 1640 wrote to memory of 2668 1640 cmd.exe Audio.pif PID 1640 wrote to memory of 2668 1640 cmd.exe Audio.pif PID 1640 wrote to memory of 2668 1640 cmd.exe Audio.pif PID 1640 wrote to memory of 2784 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2784 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2784 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2528 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2528 1640 cmd.exe alpha.exe PID 1640 wrote to memory of 2528 1640 cmd.exe alpha.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\lNV-9088759885958.cmd"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵PID:2600
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵PID:2804
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\lNV-9088759885958.cmd" "C:\\Users\\Public\\Audio.mp4" 92⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\lNV-9088759885958.cmd" "C:\\Users\\Public\\Audio.mp4" 93⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 122⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 123⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Public\Libraries\Audio.pifC:\Users\Public\Libraries\Audio.pif2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2668 -
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S2⤵
- Executes dropped EXE
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD524eca41b035ab826934e998b874398b0
SHA15da0772e30198aa9f489de683880f3b14be6d916
SHA256716743d7e555b18a15ad8aa93ab7b87c456d556425fe716c2b00461973af6c55
SHA5122b4d1b4e623d4e0109403fa8f6f9ddc7a0ff9ac0f6f7373ce1f2c66afe5d926f04b20d0bed85ffe7e254d5f2134af4c322a1aebba15e3bdb0f566ab973855484
-
Filesize
1.5MB
MD5ab0d98b37da9c1bd33adec509689fa4e
SHA14ca1a3f7bd543878dce7104473ee43b2ab783628
SHA25678e62a907f38c42e9eb2ef88ebab24a157e68eeba1210b4d6a2aa0eb919202ff
SHA512d581f6a466c6e432a08b3a550179f88a6bb9cdeba8d0ba97e609201841442014dc04f4170c11ee2f776170941421dfe0873c705785a60301dc4e60668a574567
-
Filesize
337KB
MD55746bd7e255dd6a8afa06f7c42c1ba41
SHA10f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA256db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
SHA5123a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
-
Filesize
1.1MB
MD5ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA2561e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
SHA5124e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2