Overview
overview
10Static
static
10AKUMA/__py...10.pyc
windows7-x64
3AKUMA/__py...10.pyc
windows10-2004-x64
3AKUMA/__py...11.pyc
windows7-x64
3AKUMA/__py...11.pyc
windows10-2004-x64
3AKUMA/__py...12.pyc
windows7-x64
3AKUMA/__py...12.pyc
windows10-2004-x64
3AKUMA/__py...11.pyc
windows7-x64
3AKUMA/__py...11.pyc
windows10-2004-x64
3AKUMA/__py...10.pyc
windows7-x64
3AKUMA/__py...10.pyc
windows10-2004-x64
3AKUMA/__py...11.pyc
windows7-x64
3AKUMA/__py...11.pyc
windows10-2004-x64
3AKUMA/__py...12.pyc
windows7-x64
3AKUMA/__py...12.pyc
windows10-2004-x64
3AKUMA/__py...10.pyc
windows7-x64
3AKUMA/__py...10.pyc
windows10-2004-x64
3AKUMA/__py...10.pyc
windows7-x64
3AKUMA/__py...10.pyc
windows10-2004-x64
3AKUMA/__py...11.pyc
windows7-x64
3AKUMA/__py...11.pyc
windows10-2004-x64
3AKUMA/__py...12.pyc
windows7-x64
3AKUMA/__py...12.pyc
windows10-2004-x64
3AKUMA/f.l.e.a.t..exe
windows7-x64
10AKUMA/f.l.e.a.t..exe
windows10-2004-x64
10Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 19:51
Behavioral task
behavioral1
Sample
AKUMA/__pycache__/banner.cpython-310.pyc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AKUMA/__pycache__/banner.cpython-310.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
AKUMA/__pycache__/banner.cpython-311.pyc
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
AKUMA/__pycache__/banner.cpython-311.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
AKUMA/__pycache__/banner.cpython-312.pyc
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
AKUMA/__pycache__/banner.cpython-312.pyc
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
AKUMA/__pycache__/ddos.cpython-311.pyc
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
AKUMA/__pycache__/ddos.cpython-311.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
AKUMA/__pycache__/deanon.cpython-310.pyc
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
AKUMA/__pycache__/deanon.cpython-310.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
AKUMA/__pycache__/deanon.cpython-311.pyc
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
AKUMA/__pycache__/deanon.cpython-311.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
AKUMA/__pycache__/deanon.cpython-312.pyc
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
AKUMA/__pycache__/deanon.cpython-312.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
AKUMA/__pycache__/get_ip.cpython-310.pyc
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
AKUMA/__pycache__/get_ip.cpython-310.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
AKUMA/__pycache__/mail.cpython-310.pyc
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
AKUMA/__pycache__/mail.cpython-310.pyc
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
AKUMA/__pycache__/mail.cpython-311.pyc
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
AKUMA/__pycache__/mail.cpython-311.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
AKUMA/__pycache__/mail.cpython-312.pyc
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
AKUMA/__pycache__/mail.cpython-312.pyc
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
AKUMA/f.l.e.a.t..exe
Resource
win7-20240611-en
General
-
Target
AKUMA/__pycache__/deanon.cpython-310.pyc
-
Size
2KB
-
MD5
122faa468443fce4d336bdf5202999c8
-
SHA1
ef619e865acf5103fbc014e0b0e9a0be6a072e7b
-
SHA256
ebb59808cf01936445549946ed9aa4affbfe305ae0206a5151e49794178449b9
-
SHA512
3413a7db8bdb6f75bb6c0f4449b7ec60f78c51d15609ba9041c8cf233beae7540cc35d0a4c2660cc5cb56b942a717f6f8ec2625181b017341a01084382317a27
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2668 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2668 AcroRd32.exe 2668 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2840 wrote to memory of 2280 2840 cmd.exe rundll32.exe PID 2840 wrote to memory of 2280 2840 cmd.exe rundll32.exe PID 2840 wrote to memory of 2280 2840 cmd.exe rundll32.exe PID 2280 wrote to memory of 2668 2280 rundll32.exe AcroRd32.exe PID 2280 wrote to memory of 2668 2280 rundll32.exe AcroRd32.exe PID 2280 wrote to memory of 2668 2280 rundll32.exe AcroRd32.exe PID 2280 wrote to memory of 2668 2280 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AKUMA\__pycache__\deanon.cpython-310.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AKUMA\__pycache__\deanon.cpython-310.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AKUMA\__pycache__\deanon.cpython-310.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5bc25f6845be25c1feb3fb77869e47e3e
SHA1cf819a3034d74c58f65dcd269a9e955a70c23204
SHA256cd2f2673c3b150fca627bff008e53399aab8b500fbb577a62e85416aac87f2f5
SHA51201c336a7c9a7b2cabe223c57da93ccd5e1f754dbdf6e35f587c2b6c4df89f73f6a35f4879d7ac59fde1b0b837a05dea79fd60257cf647bdc6c5a058e0ad59796