Analysis
-
max time kernel
119s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 06:29
Static task
static1
Behavioral task
behavioral1
Sample
815c519c72a50051d4cebaff3f4d2810N.exe
Resource
win7-20240708-en
General
-
Target
815c519c72a50051d4cebaff3f4d2810N.exe
-
Size
56KB
-
MD5
815c519c72a50051d4cebaff3f4d2810
-
SHA1
bdb780f001c05599f825776d62e54d5c6c38fd91
-
SHA256
5eab0cfa0f6c916740515e4ea6389ca0a55c1108c993532143e962d1f289c122
-
SHA512
eb72003d8ee4fbc469a8a735af81317721dfe96a4dc67f2b5c6f1b4c1c24870d2581aaee3c2641495969ad699a66b8235dcb1a356099e5c39ef5a8c7c158b86d
-
SSDEEP
1536:MQPzemdaNqAPG17k74qlmbbVgYyvxcd5jnGWqN7kS88k:MOemdTd1o74qlmbbJ+x+Ik6k
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
pid Process 2292 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2472 biudfw.exe -
Loads dropped DLL 1 IoCs
pid Process 2088 815c519c72a50051d4cebaff3f4d2810N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2472 2088 815c519c72a50051d4cebaff3f4d2810N.exe 31 PID 2088 wrote to memory of 2472 2088 815c519c72a50051d4cebaff3f4d2810N.exe 31 PID 2088 wrote to memory of 2472 2088 815c519c72a50051d4cebaff3f4d2810N.exe 31 PID 2088 wrote to memory of 2472 2088 815c519c72a50051d4cebaff3f4d2810N.exe 31 PID 2088 wrote to memory of 2292 2088 815c519c72a50051d4cebaff3f4d2810N.exe 32 PID 2088 wrote to memory of 2292 2088 815c519c72a50051d4cebaff3f4d2810N.exe 32 PID 2088 wrote to memory of 2292 2088 815c519c72a50051d4cebaff3f4d2810N.exe 32 PID 2088 wrote to memory of 2292 2088 815c519c72a50051d4cebaff3f4d2810N.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\815c519c72a50051d4cebaff3f4d2810N.exe"C:\Users\Admin\AppData\Local\Temp\815c519c72a50051d4cebaff3f4d2810N.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
PID:2472
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
PID:2292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD57cdc8777d33db85bc19aefb64879a7f7
SHA1f2d494d4dfe93a05eb58513935196e8578648adf
SHA2569af382db716e39144dda99d3d9afbd5df9b65e6a36af229e715c00539bce6336
SHA51234b075db80bf3704f76f9dd28eedffe88c9b3b5f730c79c27b9908fe2865847ae925487de2dcc1a8566bd3836d3b770ca3831d0b110312376684a92e42c6b48f
-
Filesize
276B
MD520b1348571562bbb719adce0f53c43ed
SHA1a1fe8a193779dc356c90cc83bc978f6eebfd2a29
SHA2567d4b8fa2e4deff14dfd4ed3be2497311350d8b32622d11164521b1994301f8d9
SHA512101adf1a271656ada5d9651092cfa2009c603ebefc7a981e63b1dc776122a0b57ce5beef396721120ec10f3e620c937c38c4daeeb79c04daa306986fe4925e71
-
Filesize
56KB
MD576d4373444be71064ed15ae25938830e
SHA1e62ad48949ab6a8464bdccc760ead1d92b80ec9a
SHA2567128dff2a302ae6a3478b77084892795bda555bba0db0fdf78b2e7e4ea643ac9
SHA5124d4beb627664b6d1e9059725b274e25f820f0a281e4ad2d859770e64488f0d860f39c322f29923b3cd4ee5695debc10dc606aae9f48b51a9b6948ebfcf8f271b