Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 07:54
Static task
static1
Behavioral task
behavioral1
Sample
PO#8586.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PO#8586.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
General
-
Target
PO#8586.exe
-
Size
584KB
-
MD5
1b3338a849721abf60efec1f28901ffa
-
SHA1
6da8a229ee3aaa589f161d1bf9b16f0cd5118730
-
SHA256
53a75b58c18af831e5df638291570b99235bf9e4b4ce9e4fca7cd13da3df6f25
-
SHA512
620634f18536dd1b06143814015423307e25f47e1336a3f9cf47ddadd2daaa462459ea6ae38fd0792532d6fe05433f988418006e91fd04a55f4e341ee89cc70b
-
SSDEEP
12288:VmnpcT6/18retJCCWZFv28MC6YWPCPFhenvh1dZk7SBu:Vmn2iZIdnMCOC3ep1U7SBu
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
PO#8586.exepid process 2332 PO#8586.exe 2332 PO#8586.exe -
Drops file in Program Files directory 1 IoCs
Processes:
PO#8586.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\overtyde.ini PO#8586.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2104 2332 WerFault.exe PO#8586.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
PO#8586.exedescription pid process target process PID 2332 wrote to memory of 2104 2332 PO#8586.exe WerFault.exe PID 2332 wrote to memory of 2104 2332 PO#8586.exe WerFault.exe PID 2332 wrote to memory of 2104 2332 PO#8586.exe WerFault.exe PID 2332 wrote to memory of 2104 2332 PO#8586.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#8586.exe"C:\Users\Admin\AppData\Local\Temp\PO#8586.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 5202⤵
- Program crash
PID:2104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD50588a5641b3acef5cd5e0fced8286529
SHA1c4465e00f4260c677c678f27924352e70706d1ad
SHA256d802a2ae71bb03d382576bfb3f3cb9dcf58387cdc7d8577614fc0a6b3eb071a1
SHA512faa408f26430d05a6263b8ee22cf64eebf2148708a161f91458b10b826e3c9b7773ec6e089cc0eb59acb6c7d94aebea8c5ddd70241457c0b89ca69e1df8b6b32
-
Filesize
882B
MD567e9cf5fc1938c927afe0eb70c584458
SHA14207e26317b9d015f0dba8e2e19c58e3919f2c4a
SHA256e91a5fe45166bbb9c7b3865db3dd86c0cdc89cb8bc9821c85945d5816e46cb98
SHA512c42538be94b98f4da7478e1762bd522b823032ee7d809b07cc68b7f3d8a497e38e24ed587f3007b93c76791d269f5ad92c5eae279c396771c9962abd5881cb3f
-
Filesize
46B
MD546bc3b3f30f2703822d77228cf71c47f
SHA1880c185810ea2b075648c9d0aac41487c8383059
SHA2568bf4c616c9a55aafdc1a48ebdb11f8fbea6fb2465aa2f216e4efad6d540a1d99
SHA512b8dd0e24989ee9acf9eb6b86dfb7f87d1d11f96458981170b7557aa1e26bb995a9ff785c8a98a54327ab12a7868d9c404b221e5f09e401d431dbb0120042946d
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
26B
MD5bc970bd8ec8acf8ac1ada9e444673a39
SHA16c03dfa1c2595129e8e0e2428fceb0f2df7f82a7
SHA2560092de36b51381e4fe5e613bdbae906f0c6e8691fec4a93f82b876f1af826648
SHA512c3fc2d8b396b6753759b532bb9e91d015a039476ec2cf8abcd4c6d4d32b9305146752743692486bd4e3984325a7e9c6db0ff4d902c2879993789573f9cdca3b0
-
Filesize
4B
MD5cde63b34c142af0a38cbe83791c964f8
SHA1ece2b194b486118b40ad12c1f0e9425dd0672424
SHA25665e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d
SHA5120559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c
-
Filesize
7B
MD567cfa7364c4cf265b047d87ff2e673ae
SHA156e27889277981a9b63fcf5b218744a125bbc2fa
SHA256639b68bd180b47d542dd001d03557ee2d5b3065c3c783143bc9fb548f3fd7713
SHA51217f28a136b20b89e9c3a418b08fd8e6fcaac960872dc33b2481af2d872efc44228f420759c57724f5d953c7ba98f2283e2acc7dfe5a58cbf719c6480ec7a648b
-
Filesize
8B
MD5c3cb69218b85c3260387fb582cb518dd
SHA1961c892ded09a4cbb5392097bb845ccba65902ad
SHA2561c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
SHA5122402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
-
Filesize
44B
MD5556e3b35bb191bcec8b2ee2bed0f51e7
SHA17e529327fd64604aebe756cc07e837acddccf1c5
SHA2567978a31934d6a6e427342480ff47382d9108a6b4730bf05477235fa83a59c53e
SHA5129ebcfabdb7579d4c77b45ca1cc2519b62ec8ca33d4029d40b967f31428a478b683bdda50eb29ce7d239268a4257c197ba6faae5241fa21c78b5a3ea7a8ab63d6
-
Filesize
1B
MD58ce4b16b22b58894aa86c421e8759df3
SHA113fbd79c3d390e5d6585a21e11ff5ec1970cff0c
SHA2568254c329a92850f6d539dd376f4816ee2764517da5e0235514af433164480d7a
SHA5122af8a9104b3f64ed640d8c7e298d2d480f03a3610cbc2b33474321ec59024a48592ea8545e41e09d5d1108759df48ede0054f225df39d4f0f312450e0aa9dd25
-
Filesize
2B
MD525bc6654798eb508fa0b6343212a74fe
SHA115d5e1d3b948fd5986aaff7d9419b5e52c75fc93
SHA2568e5202705183bd3a20a29e224499b0f77a8273ee33cd93cca71043c57ad4bdfc
SHA5125868c6241ed3cfcc5c34bfe42e4b9f5c69e74975e524771d8c9f35cafc13fd01cd943ec4d8caefee79a1f4a457e69d20b7a86f88db83a5bc3e6bd8a619972898
-
Filesize
3B
MD54e27f2226785e9abbe046fc592668860
SHA128b18a7f383131df509f7191f946a32c5a2e410c
SHA25601a219245e1501fee01ce0baea8f6065ce5162cea12fa570689a07c9717be81d
SHA5122a23585835bdb5db8175cab265566042282841efdcee8aaba8b9b5d466b0f165c0c5973033ce94bb9a8f07a956689247981ea07ac5a51408263e1653d9710adb
-
Filesize
6B
MD550484c19f1afdaf3841a0d821ed393d2
SHA1c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b
SHA2566923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c
SHA512d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b
-
Filesize
12B
MD5558ec0e73952eb4a395e7f17eb69221e
SHA1d1cb97bfc8d9fad9eab7d19e685029b5f7084709
SHA2564d8a1cb0f83d824cec9e15e4d45605ed2cc92ae959602d0cc8873b0125d4cd74
SHA512698fb90fadb2b22ce78f874dac04c2f0bf72340d39f135e7736afdb9a9b28c9c55a8c6c9f871676134e6d057a90afc2944d1f1e8a117cc0f7a90c8d9b60c5dbe
-
Filesize
18B
MD5cd0c38af71efb097ce402c588b17ff09
SHA18da4e54a7b95932f752a88ea416fa31d0c7c2fbe
SHA2561630fc3705a57982a8939a6550615a92d8998f0c3394caeca0ae3019427ec50a
SHA51203603368dbca419de6ad8ef10bb6c9670e83f06d2b3b7d7b5ebccf255473d7abb1cca1c7e0f2c2d49cd3f84c599ee5e71b03582567c95f3f76d5e54931a6ed06
-
Filesize
11KB
MD5e23600029d1b09bdb1d422fb4e46f5a6
SHA15d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA2567342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
SHA512c971f513142633ce0e6ec6a04c754a286da8016563dab368c3fac83aef81fa3e9df1003c4b63d00a46351a9d18eaa7ae7645caef172e5e1d6e29123ab864e7ac