Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25-08-2024 06:22
Behavioral task
behavioral1
Sample
nat-recoil-macro.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
nat-recoil-macro.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Stub.pyc
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Stub.pyc
Resource
win10v2004-20240802-en
General
-
Target
Stub.pyc
-
Size
875KB
-
MD5
97521afbcf977118f5bfeba89c07c62e
-
SHA1
f33bb4ce98bee2eb581601800db4a0a865458059
-
SHA256
c05ab7991ae21a9502f8509b8985851ec4960ecf988deaaf6e2d211dfd49d3d4
-
SHA512
d6f019ee011e5516fbd0e473c239ca5d53d1e5f85b2495c20c7432dd66ba7f4f4ffc069c7ead8cf5e1328c1210fa6343f817e260818a0840968443bf7e52a959
-
SSDEEP
12288:XyrsReA+vUi619thbgd1Ekk5MwEt4cVvXSV3SKZw8mfJPQ/mXbLTpnQo9nOu:XyIIAMAadKkk2v8aZQ/clnQo95
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2904 rundll32.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe 2904 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2864 AcroRd32.exe 2864 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2904 2996 cmd.exe 31 PID 2996 wrote to memory of 2904 2996 cmd.exe 31 PID 2996 wrote to memory of 2904 2996 cmd.exe 31 PID 2904 wrote to memory of 2864 2904 rundll32.exe 32 PID 2904 wrote to memory of 2864 2904 rundll32.exe 32 PID 2904 wrote to memory of 2864 2904 rundll32.exe 32 PID 2904 wrote to memory of 2864 2904 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2864
-
-