9ba08206b8796c906d98074d85a7add4fc59c105ab0b582e0f23f63df21dfaf7

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c63150becf4face705bdb6d2944e49d0.exe
Size

49KB
MD5

c63150becf4face705bdb6d2944e49d0
SHA1

9a2d5d1023878182c7d40bae880e7e31a9d1f14a
SHA256

9ba08206b8796c906d98074d85a7add4fc59c105ab0b582e0f23f63df21dfaf7
SHA512

a8b6828f2943e7e549c073d8c3bbc52d822b361513df675556502a7eb4df79b5bfcae2f09e7adb4be55927f14022d843fc6ad13186c7aaee1f91e6d1e82e5509
SSDEEP

1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszsbKY1x5hjatshMP9:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7v

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2924	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
1304	c63150becf4face705bdb6d2944e49d0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1304	c63150becf4face705bdb6d2944e49d0.exe
2924	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2924	1304	c63150becf4face705bdb6d2944e49d0.exe	28
PID 1304 wrote to memory of 2924	1304	c63150becf4face705bdb6d2944e49d0.exe	28
PID 1304 wrote to memory of 2924	1304	c63150becf4face705bdb6d2944e49d0.exe	28
PID 1304 wrote to memory of 2924	1304	c63150becf4face705bdb6d2944e49d0.exe	28

C:\Users\Admin\AppData\Local\Temp\c63150becf4face705bdb6d2944e49d0.exe
"C:\Users\Admin\AppData\Local\Temp\c63150becf4face705bdb6d2944e49d0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
49KB

MD5
ea04b9900fbc449b87ae14ca005a5723

SHA1
c167bad386e7c5f7465d8121c8f8cc58068b511b

SHA256
8aeac81c52b609b4a048c9089682cd6feea4c46a1480ee69597409b4735231fe

SHA512
3917e33a9ee3e6b76b9a3c0f6b0096cd6c553a27ae1183c3c23dd65e6b250a2774cb16e4255c3a2aa8610affbaf1f9183104d52868d5adf009028f7395e694db

Download Submit
memory/1304-0-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1304-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/1304-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download