Overview

overview

10

Static

static

10

Botnets PA...t].exe

windows7-x64

8

Botnets PA...t].exe

windows10-2004-x64

8

Botnets PA...d9.dll

windows10-2004-x64

1

Botnets PA...ip.dll

windows7-x64

1

Botnets PA...ip.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...vg.exe

windows7-x64

3

Botnets PA...vg.exe

windows10-2004-x64

3

Botnets PA...til.js

windows7-x64

3

Botnets PA...til.js

windows10-2004-x64

3

Botnets PA...ib.dll

windows7-x64

1

Botnets PA...ib.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...ip.dll

windows7-x64

1

Botnets PA...ip.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...mm.exe

windows7-x64

3

Botnets PA...mm.exe

windows10-2004-x64

3

Botnets PA...UI.exe

windows7-x64

8

Botnets PA...UI.exe

windows10-2004-x64

8

Botnets PA...ce.dll

windows10-2004-x64

1

Botnets PA...ip.dll

windows7-x64

1

Botnets PA...ip.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...32.exe

windows7-x64

3

Botnets PA...32.exe

windows10-2004-x64

3

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09-08-2024 19:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Botnets PACK/Botnets PACK/Atmos BOTNET Builder/forms/Launcher.exe

  • Size

    53KB

  • MD5

    c6d4c881112022eb30725978ecd7c6ec

  • SHA1

    ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

  • SHA256

    0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

  • SHA512

    3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

  • SSDEEP

    768:FKtnBTTQi/YqMFlVt52ftDhKeoNzZq8OujxUu5XEAb4b9yvMzUV5:qBTUgYFveDRuFEAb4b99QV5

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 1 IoCs
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 49 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\Atmos BOTNET Builder\forms\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\Atmos BOTNET Builder\forms\Launcher.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2696
    • C:\Windows\IMF\Windows Services.exe
      "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\IMF\Secure System Shell.exe
        "C:\Windows\IMF\Secure System Shell.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2528
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1376
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1128
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1124
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2872
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1700
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:472
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2272
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2244
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3060
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:932
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:976
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2896
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2956
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2860
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2236
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1576
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2284
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1208
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1692
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:548
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2788
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2720
      • C:\Windows\IMF\Runtime Explorer.exe
        "C:\Windows\IMF\Runtime Explorer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2816

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\IMF\Runtime Explorer.exe
    Filesize

    144KB

    MD5

    ec70c6f4dc443c5ab2b91d64ae04fa8e

    SHA1

    43eb3b3289782fced204f0b4e3edad2ba1b085b7

    SHA256

    276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d

    SHA512

    6217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584

    Download Submit

  • C:\Windows\IMF\Secure System Shell.exe
    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

    Download Submit

  • C:\Windows\IMF\Windows Services.exe
    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

    Download Submit

  • memory/1560-38-0x0000000001190000-0x00000000011A2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2444-0-0x000000007456E000-0x000000007456F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2444-1-0x0000000000EE0000-0x0000000000EF4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2444-2-0x0000000074560000-0x0000000074C4E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2444-3-0x0000000000AF0000-0x0000000000B6E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/2444-4-0x0000000074560000-0x0000000074C4E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2444-39-0x0000000074560000-0x0000000074C4E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2528-49-0x0000000000D90000-0x0000000000DA2000-memory.dmp

    Filesize

    72KB

    Download