09072024_0938_09072024_0098-432.IMG
- SHA256 9b4b08df3d4c1b28e9d6155edd08d844cb91051910007fe458bded8139fb228c
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Ungutturally.exe
Resource
win7-20240704-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ungutturally.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 09072024_0938_09072024_0098-432.IMG
- Size 1.2MB
- Sample240709-ll2pfsxbpj
- SHA256 9b4b08df3d4c1b28e9d6155edd08d844cb91051910007fe458bded8139fb228c
- MD5 ece4ec11900048ff532d23140c753c60
- SHA1 007a4e5a173d376211115a060bf74b31b54bfba9
- SHA512 1cde5800ad207224abfc7d7ba2f758ea07f7ef5bc5b7b9b910ee26768cc1cac494046693a1a17d10b87e3d3045f925b9b0a1554354769c02648d6a4a21f08dc2
- SSDEEP 12288:5gPut44ew0JzpED/IrP8R+M8BzIRyR947dr7tBL:i1Fw03S/uPDM8RIQ4Jd5
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Ungutturally.bat unpack003/$PLUGINSDIR/System.dll
File Explorer
-
09072024_0938_09072024_0098-432.IMG.iso 1.2MB
-
out.iso.iso 1.2MB
-
Ungutturally.bat.exe 457KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
6cfc.jpg.jpg 37KB
-
Etpartisystemers.Sub231242KB
-
Sekretions219/Cubation116.bje6KB
-
Sekretions219/Gryphon.try5KB
-
Sekretions219/Vandvrksvand.pap12KB
-
Sekretions219/bloodhound.txt447B
-
Sekretions219/coprincipals.obs5KB
-
Sekretions219/drachmal.mod7KB
-
Sekretions219/fiskemel.bit2KB
-
Sekretions219/preretirement.veg2KB
out.iso
- SHA256 9b4b08df3d4c1b28e9d6155edd08d844cb91051910007fe458bded8139fb228c
- MD5 ece4ec11900048ff532d23140c753c60
- SHA1 007a4e5a173d376211115a060bf74b31b54bfba9
- SHA512 1cde5800ad207224abfc7d7ba2f758ea07f7ef5bc5b7b9b910ee26768cc1cac494046693a1a17d10b87e3d3045f925b9b0a1554354769c02648d6a4a21f08dc2
- SSDEEP 12288:5gPut44ew0JzpED/IrP8R+M8BzIRyR947dr7tBL:i1Fw03S/uPDM8RIQ4Jd5
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Ungutturally.bat
- IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
- SHA256 d16dbafb5626e7299ec1deb1f87872b3fcd8f653c30bf99da53f5271003fe731
- MD5 dc19646e2fb2a570c359460628e8d122
- SHA1 60a930c4b6740bc5cd48894387f9d893fc49cc49
- SHA512 659028c4d9c72489089b724c0c8c608eec3c01a7e3392a0d6b6258c3cdea757c81abf0a41e9cf82c341a4b4e17f4bd98ca17ae6c1b10895276084298cf4bb9b5
- SSDEEP 12288:OgPut44ew0JzpED/IrP8R+M8BzIRyR947dr7tBLb:B1Fw03S/uPDM8RIQ4Jd5b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
12960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
MoveFileW
SetFileAttributesW
GetCurrentProcess
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
WaitForSingleObject
CopyFileW
CompareFileTime
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GlobalUnlock
lstrcpynW
GetDiskFreeSpaceW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
140KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
- MD5 a4dd044bcd94e9b3370ccf095b31f896
- SHA1 17c78201323ab2095bc53184aa8267c9187d5173
- SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
- SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10183
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
610B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
6cfc.jpg
- SHA256 17c64bc0936f294d85eb42803c8dd0294504fa1e1d668f62d7367792ba5964f2
- MD5 37a7470f2d7e67a1568c592be612fc20
- SHA1 bc850ae91f3a3610d6a3f924f70e132a348013c7
- SHA512 fe13e23a92ef67c283d583c6b53346a81f67780b12b15f034c7384b3751d4dcb4437d53daa774c66b243fe2d4c9fdf90ec2a88218df990dd8384387c8f5db859
- SSDEEP 768:BSVD9iBzq/hIKD17x555McwniJJrSWfcn7zUaIQjwkriD+E98bN:EVD97/hImJeWUzIQaFaN
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Etpartisystemers.Sub231
- SHA256 217e9e786b7f93f6dc0efd33e09b316b1a13273a191ebcc131b391375be95ee2
- MD5 83085eaf18e55f0a7796530d1de5178a
- SHA1 83ad566190c38eae43689e030a06975afdc8bcb2
- SHA512 7fec4cc2b4a91e48bd14208ff6087041266f06e7e71d1afa8924768ebfff9d94ea85b6bb848ad6ca25c47bdd9462857e3a7727f554a013444b84ceb1faaf5803
- SSDEEP 6144:7HVIk5yWXXJmK+rcc5BGvV+9ReNF73hdgI:7Hj5yWpmi+M+XeNFdKI
- MD5 SHA1 SHA512 SSDEEP
Sekretions219/Cubation116.bje
- SHA256 62a713e87fe9f0f0ac0ce60d96de3b0b1789f2741036a095b2fadd37b8dac641
- MD5 dc0076c1c2765b978c8d6a6ed7e7dd59
- SHA1 a2f2aefa7ed336cb6f23bbe8c2db0cc14ba25922
- SHA512 85fad2c20e78add966aa954ce899c5e167349198f59051cbd32a73f56688e0538815fd30a34cb16fa8a93265fe60e28525f90fc520401a319237ae811da10d39
- SSDEEP 96:Dlz7kkCJa46qog2at6dNYqB/HtVzbCH5cmcoZTzV6bHgowm+biNFcqhA3ydMv3:DniJ2aeB/bzku5uTcbHgowm+biZny
- MD5 SHA1 SHA512 SSDEEP
Sekretions219/Gryphon.try
- SHA256 fbf9511ea1be056b02f2fb5e61aa8ecd29675c97af9669c4adcd8e9c397b8257
- MD5 32cf6bcd3123b9471ae0d87a4a0eceeb
- SHA1 7f3ff8fd2f701207171048390f8be628d5ad93bd
- SHA512 7c487bec5cde22576657e61a2ea170e2a361758d7106e0f690a4220914cb7c18686e08e5fe30b5b8c46afc5a6f83e28ec175d3985241742a81afd7ad1382f2ec
- SSDEEP 96:JB7e6etdIqk4UTAQamh8CK+O2Ekj9JyxBDWCrzXdXutLTtRNf9:DhetdW4cFh8CxEkj9UjDWCrzNXutLZjV
- MD5 SHA1 SHA512 SSDEEP
Sekretions219/Vandvrksvand.pap
- SHA256 ac0e0202dfdcc12f10415e60fd61e8565406fb199fd15c4f0f1aad2a8db10b9f
- MD5 0dd6646211b0ce4629aee5e497cc7525
- SHA1 8cc7b51dfd64b8db7110205c09771f4962fc700f
- SHA512 d44a81e73d2b7cfa0dd5c9e718074cf7d2741d4cef6c13a85f353cf632aa70c1657eb8c6cd174a20bd36c19ae1d6cb16895df2c681b24cb2ea5672c7b9b898dd
- SSDEEP 192:JxVM/WIFfh8K479O2OHAjkZOxyVEFyxzu9hqpbnoJVt8hDgrMQ0:JTidf+M2OHHSI1x+quODgQQ0
- MD5 SHA1 SHA512 SSDEEP
Sekretions219/bloodhound.txt
- SHA256 e8198da554746795bbb91a4131b53005c09e53f54ace7d9b0c56ae147e0dab46
- MD5 264c818bdf75b2f241cd79381cd503dc
- SHA1 5b32914e76fece7e155478520838d998edb3484b
- SHA512 1290b5356ac279a2833a69d11a85c1ade9d525b383a9814861bc4f615a9d678b760f663e8edae470b6bfa17d74d789c0274270ddb5709abd87377117ab6ce730
- MD5 SHA1 SHA512
Sekretions219/coprincipals.obs
- SHA256 f9de05e7efb81902614ec5801ca666af0ea93bf608d9f0e2a7b20d47a1edb737
- MD5 0ab5be5086e04ae206fb3117dd2e318f
- SHA1 11f41714f9a927119da865396c2311891437b645
- SHA512 b35dba25b084947b7eb5ac428c9637285465a1576dd813f79df39f011c8459631a9a64816b111f684cc9f5f850b5dea7fad2d1b7d8c7b1a7c19839aee8994022
- SSDEEP 96:VmqmCsjN6Ls849ctDCmVdbHSJHEqiaIn9nP/vILRFr:cqlspkZD3FHOHg9PILrr
- MD5 SHA1 SHA512 SSDEEP
Sekretions219/drachmal.mod
- SHA256 f6f218bbee1797764f424f3882cd14db36733d19676cbd4c9859cf3faffed3dd
- MD5 835675916e4ed76d2cfe5322d0a23c5f
- SHA1 5c76d218af050194b166eea08f554e8381b93f70
- SHA512 7608daabdbfee41cc6eaae0849178557ad0f2302bbd26df8d5a4148e08bc32391e30e6741be7d6527dff6206d4b9b967551e712d62ff290873bfa6f75b138a52
- SSDEEP 96:O2mKFTUsyjXGcIYXiM+/7wQBFRMTwpapl0f/qHavgM0fVt7q2piyE8Rl9dIrk:QK9UbbiM+jwWQkapl2/x0fJpfE8JJ
- MD5 SHA1 SHA512 SSDEEP
Sekretions219/fiskemel.bit
- SHA256 38fed07f4e05b48d458b1421911858a40962d87bf386f3ef4c2adbdbe3b97213
- MD5 03157ba72d52912f58925158f3d6c724
- SHA1 e1ba82d4b485e6e30251b4fdc355c63465a41d23
- SHA512 385d1c2dbcdce4aac1779cefbf252475cff160d9034f80e90c6a7eeb93ce70787538e46f14882bc16bd895b74fd67930310070dbb26f8afa59d80ce48cad1e71
- MD5 SHA1 SHA512
Sekretions219/preretirement.veg
- SHA256 aef4b2288fddf258f8b480528024b73e589c0b7bc951c4b8296b9441bb559033
- MD5 dbc2eab37949c0e68e4f78b2df533baa
- SHA1 0ce77ed47343c270aa8eec3acd0c6caafcde67e0
- SHA512 faaf357eeb50e2781f19b52725129bde3d0a79f666c24f4dce75eb5c377f52f59f73c44ce823d32f4a11ad1c559299cd30a00356190c419f52db136a6a04b591
- MD5 SHA1 SHA512