4ab756f03eb0b4b9a9440403bafe4bc4f37d418555dc2e40ef451aa87dd5176b

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Solyum-defibot/trading_bot.py
Size

1KB
MD5

d19cad05b3477aa3f230c4eb3c73e9cc
SHA1

441a2c15490469d674b63c3b53cfebe8a662ab9a
SHA256

0a0a389152d63e633694a9a8a707c4bc56347c6a09929d4e0479806fb39ab901
SHA512

d4b01efb5c8e539af9e678b1bb4dae94440a18a59b039b3d7f3d48100e8f8e5c115c567371ce18e32ea2ee766eee5ba3388de7b9648478a4aec793c503179675

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2836	AcroRd32.exe
2836	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2068	1652	cmd.exe	31
PID 1652 wrote to memory of 2068	1652	cmd.exe	31
PID 1652 wrote to memory of 2068	1652	cmd.exe	31
PID 2068 wrote to memory of 2836	2068	rundll32.exe	32
PID 2068 wrote to memory of 2836	2068	rundll32.exe	32
PID 2068 wrote to memory of 2836	2068	rundll32.exe	32
PID 2068 wrote to memory of 2836	2068	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Solyum-defibot\trading_bot.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Solyum-defibot\trading_bot.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Solyum-defibot\trading_bot.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a47b33c6eb0c21b7bace95a57bf7fced

SHA1
f37acf230b379cffa8334560b30f24678f87364c

SHA256
6e6d732477d8eeead3c9ed21c6ab5575eac4d395f44da13d37fb8b9dc085424d

SHA512
78cfb32ffff4fd0490cf65f493b8474616853ccb3ea8e22e38c05494f403d1ca2da652098ba4ce3b3fbaef0f1e47b4a9b42771b1e3c6bb11d7b2d1090c055cca

Download Submit