Overview
overview
10Static
static
10The-MALWAR...de.txt
windows10-1703-x64
1The-MALWAR....A.exe
windows10-1703-x64
7The-MALWAR....E.exe
windows10-1703-x64
9The-MALWAR....a.exe
windows10-1703-x64
The-MALWAR...ks.exe
windows10-1703-x64
1The-MALWAR...lc.exe
windows10-1703-x64
10The-MALWAR...re.txt
windows10-1703-x64
1The-MALWAR....l.exe
windows10-1703-x64
3The-MALWAR...ck.exe
windows10-1703-x64
3The-MALWAR....A.exe
windows10-1703-x64
3The-MALWAR....B.exe
windows10-1703-x64
3The-MALWAR...de.txt
windows10-1703-x64
1Resubmissions
25-08-2024 18:37
240825-w9lm9aybld 1025-08-2024 18:31
240825-w6eqjazcpm 1025-08-2024 18:25
240825-w2whgsxgjb 10Analysis
-
max time kernel
299s -
max time network
315s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25-08-2024 18:37
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Net-Worm/Blaster/Blaser.C.sourcecode.txt
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Net-Worm/Blaster/Blaster.A.exe
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Net-Worm/Blaster/Blaster.E.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Net-Worm/CodeRed.a.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Net-Worm/EternalRocks.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Net-Worm/Kolabc/Kobalc.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Net-Worm/Loveware.txt
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Net-Worm/Opaserv.l.exe
Resource
win10-20240611-en
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Net-Worm/Rahack/Rahack.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Net-Worm/Sasser/Sasser.A.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Net-Worm/Sasser/Sasser.B.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Net-Worm/Sasser/Sasser.c.sourcecode.txt
Resource
win10-20240404-en
General
-
Target
The-MALWARE-Repo-master/Net-Worm/Blaster/Blaster.E.exe
-
Size
6KB
-
MD5
8676210e6246948201aa014db471de90
-
SHA1
86b30d1a8b7515dcab6c8d2781b85c6983709dbf
-
SHA256
2e481059b9bc9686c676d69a80202eed5022c9a53ecd8cac215e70c601dd7fdc
-
SHA512
5130e6ea6c5e1924af7d630a7b1c6e614b1482edcad3117a8dc56371269260b97793a7ccdbf3249054815b7c3b9c364b30e73e0f8e4cc230502b01d0d2f70bda
-
SSDEEP
192:P+szB8G1PO6jgVFpXbWMBpbw/jsaW6HmI:P+szyLVFdbWsbKtWqmI
Malware Config
Signatures
-
Contacts a large (3326) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Blaster.E.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Automation = "mslaugh.exe" Blaster.E.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Blaster.E.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blaster.E.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2448-0-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-1-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-2-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-3-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-4-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-5-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-6-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-7-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-8-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-9-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-10-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-11-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-12-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-13-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-14-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-15-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-16-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-17-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-18-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-19-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-20-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-21-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-22-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-23-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-24-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-25-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-26-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-27-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-28-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-29-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2448-30-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB