e9d73ade3420f2ab661aa06b16c607ef40257e4f7915476a5318f8b796aa33b6

Analysis

max time kernel
119s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07a835b21842641ed7e8c199366e21d0N.exe
Size

404KB
MD5

07a835b21842641ed7e8c199366e21d0
SHA1

2545bcb62dd5b063f977eca4ba06975c653ff275
SHA256

e9d73ade3420f2ab661aa06b16c607ef40257e4f7915476a5318f8b796aa33b6
SHA512

b360d1a1cdcb937b03ecd8c28f63dea98cd16871f275d66944d6bfdc7ddbac83883adc882eb17ede4f6645e4601bb8abbe6e078467bdda3a305f4b20a758ad10
SSDEEP

6144:4jlYKRF/LReWAsUy/eA8Ti3LY+FPKZawYGMa:4jauDReWZL8Sc+hKZawYGV

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
812	oyflki.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\oyflki.exe"	oyflki.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07a835b21842641ed7e8c199366e21d0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oyflki.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 812	2264	07a835b21842641ed7e8c199366e21d0N.exe	84
PID 2264 wrote to memory of 812	2264	07a835b21842641ed7e8c199366e21d0N.exe	84
PID 2264 wrote to memory of 812	2264	07a835b21842641ed7e8c199366e21d0N.exe	84

C:\Users\Admin\AppData\Local\Temp\07a835b21842641ed7e8c199366e21d0N.exe
"C:\Users\Admin\AppData\Local\Temp\07a835b21842641ed7e8c199366e21d0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264
- C:\ProgramData\oyflki.exe
  "C:\ProgramData\oyflki.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
404KB

MD5
ed4f1b8003efb975a755f54de7ecb438

SHA1
54397e1d053ae3f6eb5d2f3bf8fcc41c45d04bf6

SHA256
88691022f58e536c7b34d1cebfb9d9769a217e0eaf67a7a35c3601ba808f9e89

SHA512
dd5c38bb9213d1afa2d3afaf76a1beb846bd4429c08bfc4bf837b763be8e259beee48d0a4a4c759feb267250cfb74381528034c8b6b7bea962a56bb82ebf24de

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\oyflki.exe

Filesize
267KB

MD5
6b93a0fc5cc29bda942746c8c96c2459

SHA1
44a300acdd5c89637509275c4fee11158c15f453

SHA256
55ca75e3c40d6fd6e7be383ee170b93f3b85efa320a8a1c381a631a65de85370

SHA512
3f452c0c60c8514133821b7dfedadfb01bc93dddd0ce4900e9a1310e62b5d8c6c36dc89891c25892c6b7b6ce65186318f41759bd9822a7716b03ecf7eebe47dd

Download Submit
memory/812-130-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2264-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2264-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2264-8-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads