Overview

overview

10

Static

static

3

af41b9ac95...78.exe

windows7-x64

10

af41b9ac95...78.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-07-2024 03:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe

  • Size

    898KB

  • MD5

    c02798b26bdaf8e27c1c48ef5de4b2c3

  • SHA1

    bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615

  • SHA256

    af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78

  • SHA512

    b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4

  • SSDEEP

    24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93

Score
10/10
discovery

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.frontiernet.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Srt4dodge$

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.netzero.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    superman

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.activecars.co.uk
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    paynio

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mx.gfgfgf.org
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    R7lmrwrf

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.netzero.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Rum2486

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nifty.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    48521122

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.mybluelight.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    sparky

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe
    "C:\Users\Admin\AppData\Local\Temp\af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        clamer.exe -priverdD
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2388
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2992
  • C:\ProgramData\skex\xibp.exe
    C:\ProgramData\skex\xibp.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
    Filesize

    37B

    MD5

    28151380c82f5de81c1323171201e013

    SHA1

    ae515d813ba2b17c8c5ebdae196663dc81c26d3c

    SHA256

    bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d

    SHA512

    46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
    Filesize

    453KB

    MD5

    a9f386515c3896a0a106940be362de47

    SHA1

    d1a9cf3c16555db4b2395d388995c2b13d2d683b

    SHA256

    12532d6bf0cdb5ea1cc0844e9ef73530456a337d5b73bb8d23e110fac46c3446

    SHA512

    7a2a4a6c7f9c426ff57066786892f4bbd7830f8c91985f1243abfd9148878345e83813eb09434b68b6616b76860d4163c1c7e32d4eb552953019fc8cb4c0a448

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
    Filesize

    16KB

    MD5

    e7d405eec8052898f4d2b0440a6b72c9

    SHA1

    58cf7bfcec81faf744682f9479b905feed8e6e68

    SHA256

    b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

    SHA512

    324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

    Download Submit

  • C:\Windows\Tasks\Test Task17.job
    Filesize

    230B

    MD5

    3e1a2727b6f500c7cb1d232f99e51183

    SHA1

    a9c08019c3f311036176ad5a220cd14c9a9c2870

    SHA256

    f0074df6f385a7cd62fd88043f89c447c6e2853e7b83e6de965a5d8ac82d925e

    SHA512

    7aed7346db89f889072537dbc258941f2eded34da8e1f1463c9415b8623ec639336828f877922fc24dea48ad0b377cf9bc67c15a18239b2c9541fc71661d3303

    Download Submit