Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
31-07-2024 01:14
Behavioral task
behavioral1
Sample
84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe
Resource
win7-20240705-en
General
-
Target
84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe
-
Size
84KB
-
MD5
166c1187a42f846248992b70afb497be
-
SHA1
cfbd1f3b3798a415139c4e336ce8ef9fa103237d
-
SHA256
84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b
-
SHA512
4565a554f0ef7a0c5ea3476d58ff95c6d4d547b18e0c9630cee0fb3ed658416718fb537cafd770eec4c48115e7f2df8541a55611d8bd2f77d39bf6d5d10e863b
-
SSDEEP
1536:Jz+jIHNv+vsFbwW6dk0QeLb4NMHriBRxiDkURG:JznH976dUCnuniDS
Malware Config
Extracted
urelas
112.175.88.207
112.175.88.208
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2052 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
huter.exepid process 1640 huter.exe -
Loads dropped DLL 1 IoCs
Processes:
84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exepid process 2860 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe -
Processes:
resource yara_rule behavioral1/memory/2860-0-0x0000000000400000-0x0000000000431000-memory.dmp upx \Users\Admin\AppData\Local\Temp\huter.exe upx behavioral1/memory/2860-6-0x0000000002BE0000-0x0000000002C11000-memory.dmp upx behavioral1/memory/1640-10-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/2860-19-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/1640-22-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/1640-24-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/1640-31-0x0000000000400000-0x0000000000431000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exe84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exehuter.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language huter.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exedescription pid process target process PID 2860 wrote to memory of 1640 2860 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe huter.exe PID 2860 wrote to memory of 1640 2860 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe huter.exe PID 2860 wrote to memory of 1640 2860 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe huter.exe PID 2860 wrote to memory of 1640 2860 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe huter.exe PID 2860 wrote to memory of 2052 2860 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe cmd.exe PID 2860 wrote to memory of 2052 2860 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe cmd.exe PID 2860 wrote to memory of 2052 2860 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe cmd.exe PID 2860 wrote to memory of 2052 2860 84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe"C:\Users\Admin\AppData\Local\Temp\84a112698b3529a4f24b244e23c3fd92027eb924349f876ef35c7c0e7f844e6b.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1640
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5a01dba4c45102fc15292fd5591166536
SHA1d96191c30e0f09439d8547f4ededbf6726ccd54b
SHA256cc2f9d3db04690b746c18d40c70f8dbc9ca18520b68619d9ccaeac500af98904
SHA512277a86f44c2648668205cd6c3c9f83feef147a5ad10839a130713eee9c931c26088d4dd95798b1d0e69f3439239abdee79d37656ad3963147a878a9433d60d32
-
Filesize
338B
MD5609ce0e460850082c0ebaa19e82c2597
SHA1b6b475a8ff74cd1ac908cb70450f7bd52dbaa8ce
SHA256b91838d7f251698e27bd43b0d199a998d2ca2f286befc70b50e23a0d8fee8e80
SHA512d416bdb10800e56f971381fa843da964abfd0697dea7ec9801ad9b9e2bd9af4e6ad9e2ec6abae66174f142e606b791172b4d38379eec7c2d119052daaa6f8e12
-
Filesize
84KB
MD5f9458c431ad6b2b318fe5e9ce2392f42
SHA1a01fc1b8defed0dbb091fe846f7c4cd1f00e5bd3
SHA2567a5db11581422b4b57007dbc31c55f1f0f5b75bcbcc3cff22c0fce70aafefba8
SHA512a0510be609e8ab9df627a6427b7e05892c0bbd5b9fc8f22b9e347e25e8cc2a5a2a07bf700b93261dfc4126f392fe4c60228d5de892b7aa4414340e096f04bf74