69943738a2f0a000191138d02b8b2395c0a110027e801da8f6a2a4ff78861c3d

Analysis

max time kernel
110s
max time network
55s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Lillian_Night_Succubus_Exclusive_Contract-v1.2.0.7z
Size

490.1MB
MD5

7f3603b7bc61ef28152b469dee518697
SHA1

8680d7d4df2af8002d8d29644db2723c524c6086
SHA256

69943738a2f0a000191138d02b8b2395c0a110027e801da8f6a2a4ff78861c3d
SHA512

e64646e02eb5642feb925e78b6a56a6824ecbd3de0c4a3eff6b0419a4e87ea7fa805caf83577d01ebdcdcc719b47f4b16c28c4c93cab6bca46d2352287621808
SSDEEP

12582912:JjgQcxnRbHCFJ0IeHceU4jGRz1SG9kfqQ9gGk:JLCntOYHCjpOCQ9gGk

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
428	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
428	AcroRd32.exe
428	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2800	3032	cmd.exe	30
PID 3032 wrote to memory of 2800	3032	cmd.exe	30
PID 3032 wrote to memory of 2800	3032	cmd.exe	30
PID 2800 wrote to memory of 2596	2800	rundll32.exe	31
PID 2800 wrote to memory of 2596	2800	rundll32.exe	31
PID 2800 wrote to memory of 2596	2800	rundll32.exe	31
PID 2596 wrote to memory of 428	2596	rundll32.exe	33
PID 2596 wrote to memory of 428	2596	rundll32.exe	33
PID 2596 wrote to memory of 428	2596	rundll32.exe	33
PID 2596 wrote to memory of 428	2596	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Lillian_Night_Succubus_Exclusive_Contract-v1.2.0.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lillian_Night_Succubus_Exclusive_Contract-v1.2.0.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lillian_Night_Succubus_Exclusive_Contract-v1.2.0.7z
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lillian_Night_Succubus_Exclusive_Contract-v1.2.0.7z"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4887eac57fc30b16298da7a1bcb2fde2

SHA1
e73f871c63b0cb3db576e79e687859ab31bb0f7e

SHA256
072a11221f41d46c26d88dd3c7f2fe8e0b7e933ac8b0bd68d18ad8f03237b07b

SHA512
215c29f93705c6cf12d3cec77eaf80572ec710c06c6bb465108ac865790b28aaf898ea7e7a1feb2cdbe63d529f1877219f70ecddb491ec07d623995ea3174961

Download Submit