Analysis
-
max time kernel
38s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07-08-2024 04:03
Static task
static1
Behavioral task
behavioral1
Sample
5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe
Resource
win7-20240704-en
General
-
Target
5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe
-
Size
281KB
-
MD5
5f3d5f8eae7c4bafe2f1e0ca83edf2e0
-
SHA1
c4bee44faaa77967652f34304091e9ea2418320b
-
SHA256
ceac954cc8a5912ee568c933fdf0c862abfa80a0638a6f1541ac3c4b691f8e92
-
SHA512
d485c791d0f6342acc8222581230877131183a6a069f2a66081f433fdcab7ca1906d7c52a8f7f1957f09a4b6eadf3efe18474cbe46b1e7b5ddf7ea99ee4ea301
-
SSDEEP
6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fKkfm:boSeGUA5YZazpXUmZhZ6S7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
a1punf5t2of.exepid process 2740 a1punf5t2of.exe -
Loads dropped DLL 2 IoCs
Processes:
5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exea1punf5t2of.exepid process 2120 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe 2740 a1punf5t2of.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\b1b2dqljdx3 = "C:\\Users\\Admin\\AppData\\Roaming\\b1b2dqljdx3\\a1punf5t2of.exe" 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exea1punf5t2of.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1punf5t2of.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exea1punf5t2of.exedescription pid process target process PID 2120 wrote to memory of 2740 2120 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe a1punf5t2of.exe PID 2120 wrote to memory of 2740 2120 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe a1punf5t2of.exe PID 2120 wrote to memory of 2740 2120 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe a1punf5t2of.exe PID 2120 wrote to memory of 2740 2120 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe a1punf5t2of.exe PID 2120 wrote to memory of 2740 2120 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe a1punf5t2of.exe PID 2120 wrote to memory of 2740 2120 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe a1punf5t2of.exe PID 2120 wrote to memory of 2740 2120 5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe a1punf5t2of.exe PID 2740 wrote to memory of 2704 2740 a1punf5t2of.exe a1punf5t2of.exe PID 2740 wrote to memory of 2704 2740 a1punf5t2of.exe a1punf5t2of.exe PID 2740 wrote to memory of 2704 2740 a1punf5t2of.exe a1punf5t2of.exe PID 2740 wrote to memory of 2704 2740 a1punf5t2of.exe a1punf5t2of.exe PID 2740 wrote to memory of 2704 2740 a1punf5t2of.exe a1punf5t2of.exe PID 2740 wrote to memory of 2704 2740 a1punf5t2of.exe a1punf5t2of.exe PID 2740 wrote to memory of 2704 2740 a1punf5t2of.exe a1punf5t2of.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe"C:\Users\Admin\AppData\Local\Temp\5f3d5f8eae7c4bafe2f1e0ca83edf2e0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"C:\Users\Admin\AppData\Roaming\b1b2dqljdx3\a1punf5t2of.exe"3⤵PID:2704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
281KB
MD5c209ad5dad2822f3f41d367ffbab4e0d
SHA1878d9d369573ee1138822c39fe506a74ea516bdc
SHA25684637f5204cbce8453fe51488103858b29be31628658272f74c3e2b24955d3c2
SHA5126ed75185c32633333a198dcf61bd42bf1420e09c9af7f02f0651f0c448662845db6145cc0a2a7c1b5790518dcbdcbb5680a7b3e98f9ee16bb83729e7710dac68