cc1ec1750f76c2cbeeb9b8e01815fd5f413f7b9f04b0568ab102c3e240100a48

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6436163200980ad752cde1484e0fe920N.exe
Size

511KB
MD5

6436163200980ad752cde1484e0fe920
SHA1

179315e5c3d09fcc6dc81bc2a483866300822bc7
SHA256

cc1ec1750f76c2cbeeb9b8e01815fd5f413f7b9f04b0568ab102c3e240100a48
SHA512

1cdb24f0a216c6722a642f6dabe43521697ea87b57b1200658b1da8dff66eb34bb74ad534cff28d95b312c6b866761b126ac69ff568f9c06b0c7bdbb6f2c240e
SSDEEP

12288:H1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0HKUjDsQB3GIbS9thh+/hhhah1:H1/aGLDCM4D8ayGMbp3GIbS9thh+/hhU

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2600	ryxqq.exe

Loads dropped DLL 2 IoCs

pid	Process
2252	6436163200980ad752cde1484e0fe920N.exe
2252	6436163200980ad752cde1484e0fe920N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\ryxqq.exe"	ryxqq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6436163200980ad752cde1484e0fe920N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ryxqq.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2600	2252	6436163200980ad752cde1484e0fe920N.exe	31
PID 2252 wrote to memory of 2600	2252	6436163200980ad752cde1484e0fe920N.exe	31
PID 2252 wrote to memory of 2600	2252	6436163200980ad752cde1484e0fe920N.exe	31
PID 2252 wrote to memory of 2600	2252	6436163200980ad752cde1484e0fe920N.exe	31

C:\Users\Admin\AppData\Local\Temp\6436163200980ad752cde1484e0fe920N.exe
"C:\Users\Admin\AppData\Local\Temp\6436163200980ad752cde1484e0fe920N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252
- C:\ProgramData\ryxqq.exe
  "C:\ProgramData\ryxqq.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
511KB

MD5
600c1d5a34ead703f89c0438d87e47dc

SHA1
b625ac13c0b89e0d31c2afe5ac514ece13b4ed98

SHA256
25f023ff88e6adb4388a882da2d7f3341c2ffeab4d6b5b80498bc644edc582ed

SHA512
e2b034f53f34bf71210039537cdefb525978e11177eb45d40e0ea7bcd89ffa23382f0a0127707c82bc1890b9fdf7e749f0993b19c1ed8fca00ffce9179ff61f7

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
255KB

MD5
f351898b5ba2d709e4d73d3160071029

SHA1
5bddf9621650635913bea3f15cb0f7108a09079e

SHA256
22972cfc5b13ea8cedef1adca83358f89fea716b3e775bd70553ed44ef04e668

SHA512
c9c680f93577ca853d9db3d9b84d16a43c1986c95d3bfc4ff3bbbafaa585cf6ee6ada6da6e86cea529e817f39e4e98d78c1ad99069aa417514ef5bab735ccf88

Download Submit
\ProgramData\ryxqq.exe

Filesize
256KB

MD5
d653528ebfe916888e134cdd1113478c

SHA1
f8312ac83ed47a35ccf41328f699a2cebdec855c

SHA256
bc1d306f72026c7966aa891452512c67a979d81347edec4aeeec019c6f659deb

SHA512
cc313831d6f5448489efe03d8ad5e3474b2f8cc1ef3f768d47be4b25627ca5de306234d4d59514545b85a9821b80c80ed5a644c3f23269bfb8b8e8a31c619c2c

Download Submit
memory/2252-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2600-102-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads