Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 17:11
Static task
static1
Behavioral task
behavioral1
Sample
d1d6eeed86f0d35c635148a9b6aee2a0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1d6eeed86f0d35c635148a9b6aee2a0N.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
General
-
Target
d1d6eeed86f0d35c635148a9b6aee2a0N.exe
-
Size
154KB
-
MD5
d1d6eeed86f0d35c635148a9b6aee2a0
-
SHA1
1e06c1635302a4c2d73189a2b56a52d9c5ae7b44
-
SHA256
5208fc46503b5f37b62a0d49954341a31f0fd14194b37ddccb786d0b32e5f19a
-
SHA512
d0a5ed3d4d8fc08ce0585186cab060968939b91e4408fad636b7c5f01380b82569de5462428a9bb17103be71e3bfac69ee40fc42150bf3f39123fa2147c64669
-
SSDEEP
3072:GUc061qIIZA7yjqvR1YC2lQBV+UdE+rECWp7hKeoxjVxB:e0xApvEIBV+UdvrEFp7hKeoxjVxB
Malware Config
Signatures
-
Detects Floxif payload 1 IoCs
Processes:
resource yara_rule \Program Files\Common Files\System\symsrv.dll floxif -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Program Files\Common Files\System\symsrv.dll acprotect -
Loads dropped DLL 2 IoCs
Processes:
d1d6eeed86f0d35c635148a9b6aee2a0N.exeWerFault.exepid process 2980 d1d6eeed86f0d35c635148a9b6aee2a0N.exe 2656 WerFault.exe -
Processes:
resource yara_rule behavioral1/memory/2980-3-0x0000000010000000-0x0000000010030000-memory.dmp upx \Program Files\Common Files\System\symsrv.dll upx behavioral1/memory/2980-7-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
Processes:
d1d6eeed86f0d35c635148a9b6aee2a0N.exedescription ioc process File created C:\Program Files\Common Files\System\symsrv.dll d1d6eeed86f0d35c635148a9b6aee2a0N.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 2656 2980 WerFault.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
d1d6eeed86f0d35c635148a9b6aee2a0N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1d6eeed86f0d35c635148a9b6aee2a0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d1d6eeed86f0d35c635148a9b6aee2a0N.exedescription pid process Token: SeDebugPrivilege 2980 d1d6eeed86f0d35c635148a9b6aee2a0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d1d6eeed86f0d35c635148a9b6aee2a0N.exedescription pid process target process PID 2980 wrote to memory of 2656 2980 d1d6eeed86f0d35c635148a9b6aee2a0N.exe WerFault.exe PID 2980 wrote to memory of 2656 2980 d1d6eeed86f0d35c635148a9b6aee2a0N.exe WerFault.exe PID 2980 wrote to memory of 2656 2980 d1d6eeed86f0d35c635148a9b6aee2a0N.exe WerFault.exe PID 2980 wrote to memory of 2656 2980 d1d6eeed86f0d35c635148a9b6aee2a0N.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1d6eeed86f0d35c635148a9b6aee2a0N.exe"C:\Users\Admin\AppData\Local\Temp\d1d6eeed86f0d35c635148a9b6aee2a0N.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 2682⤵
- Loads dropped DLL
- Program crash
PID:2656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab