Analysis
-
max time kernel
91s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 20:44
Static task
static1
Behavioral task
behavioral1
Sample
3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe
Resource
win7-20240704-en
General
-
Target
3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe
-
Size
61KB
-
MD5
1991fa7f68eb51bda59c016cc5736385
-
SHA1
857090a6439901aeca151e45507eace8d00589b0
-
SHA256
3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d
-
SHA512
3d73f857024b2fb20e338c4fae0d0db4c7562e3a7a8bb36db066ccf85fb14fb322996cc13d373926ae6de2215c8dad0bf7e95c91d34d96e674deaba7f239b239
-
SSDEEP
1536:saTkcl2v/z0thjkh6+uYLo31d0JuPrROVz:Jo0cAthu6+FQ0JuPkz
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2792 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2784 biudfw.exe -
Loads dropped DLL 1 IoCs
Processes:
3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exepid process 2860 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exebiudfw.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exedescription pid process target process PID 2860 wrote to memory of 2784 2860 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe biudfw.exe PID 2860 wrote to memory of 2784 2860 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe biudfw.exe PID 2860 wrote to memory of 2784 2860 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe biudfw.exe PID 2860 wrote to memory of 2784 2860 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe biudfw.exe PID 2860 wrote to memory of 2792 2860 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe cmd.exe PID 2860 wrote to memory of 2792 2860 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe cmd.exe PID 2860 wrote to memory of 2792 2860 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe cmd.exe PID 2860 wrote to memory of 2792 2860 3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe"C:\Users\Admin\AppData\Local\Temp\3a27f0e0ce51850fadf827aa71ac6980c8e86a8faeaa7d4af268aed4af76c54d.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5657ce9e5dd337971e44dfb9cb3fbf7dd
SHA1026734083afaa4b7d298781b26a72ac9b67ac831
SHA2563138d6a5526aaa3cb120adb309f2a27d5fec03c8aa088268a1c7f378dd722472
SHA51279aab9648bb19ebe5946dd9edd7e11a70ea7b340a1c7539ccff3d3d13de2932bf5ea9077c079208e09bf5d632f00541e52d4926c5c80f86741effb8d86acd26d
-
Filesize
338B
MD5b2f167d976fbab4ebcad72be5625f596
SHA10a79af93d0857c93a01cfd402228775c49949abb
SHA256a9465f51a25bf51cb3447e223c87bcc83f651554147eecc3f2436af2b2244c4c
SHA512f62fa12998f5c82f99068b9d9e82977fa35a02ccdd4bfdc7c97015b2e5ccc63a3294f9eec1b8c7a74908d3451750d157c5a8c0631c0ffc5e0cccff358125dee6
-
Filesize
61KB
MD5438028d040bcf9ef5e90df0abb1af5b2
SHA187c967f65a922de4a960e31992bd5484b03ba0d4
SHA256e091a36526d6f0f9bd7f66675d366ecf2983fb84614b673bf402d2e6f37be370
SHA512740f986b7da06420856b12c8cf91586367cc1e38b01420a2ab6b7563cd7ad18d3876146cda1266c1ad923460293e4fbe6997dd90dc51a1c8168b2fa9dc9f00fc