Overview
overview
7Static
static
7bbea22a537...0N.exe
windows7-x64
7bbea22a537...0N.exe
windows10-2004-x64
7$PLUGINSDI...rt.dll
windows7-x64
3$PLUGINSDI...rt.dll
windows10-2004-x64
3$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...er.exe
windows7-x64
3$PLUGINSDI...er.exe
windows10-2004-x64
3$_2_/Uninstall.exe
windows7-x64
7$_2_/Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ut.dll
windows7-x64
3$PLUGINSDI...ut.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDIR/ef.exe
windows7-x64
3$PLUGINSDIR/ef.exe
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3Analysis
-
max time kernel
92s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2024 11:18
Behavioral task
behavioral1
Sample
bbea22a537d73fb3acbb4d8072aefd00N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bbea22a537d73fb3acbb4d8072aefd00N.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BaseConvert.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BaseConvert.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Dialer.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Dialer.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Linker.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Linker.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/SimpleInstaller.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/SimpleInstaller.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$_2_/Uninstall.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
$_2_/Uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/ThreadTimer.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/ThreadTimer.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/Timeout.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/Timeout.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/ef.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/ef.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240802-en
General
-
Target
bbea22a537d73fb3acbb4d8072aefd00N.exe
-
Size
445KB
-
MD5
bbea22a537d73fb3acbb4d8072aefd00
-
SHA1
bc28e6dabd97757c553625a387c68e6a04bd7e6f
-
SHA256
e1e7a78a99ce28ac9ac72b049d2b15e226939d0bbf35dbeb4483126c7cf2a8d9
-
SHA512
9e5f6a80d57a755d87b81d37e56e9ee2204860c9d5641cf9bb8d620e38e70993b67e04cefa63a3ee4a588fe19bb6b44e9b9543195df868f3141d80f15aa64470
-
SSDEEP
12288:/MVF3cnvEy9uTk4FF1g38Hx1iCJXOyC1aNJjrlIpGPyQ0:/Mz3c79uTk4rH1fiaNhRIpGPyR
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4724 mf.exe 4108 ef.exe -
Loads dropped DLL 12 IoCs
pid Process 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 64 bbea22a537d73fb3acbb4d8072aefd00N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbea22a537d73fb3acbb4d8072aefd00N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 64 wrote to memory of 4724 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 83 PID 64 wrote to memory of 4724 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 83 PID 64 wrote to memory of 4724 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 83 PID 64 wrote to memory of 4108 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 85 PID 64 wrote to memory of 4108 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 85 PID 64 wrote to memory of 4108 64 bbea22a537d73fb3acbb4d8072aefd00N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbea22a537d73fb3acbb4d8072aefd00N.exe"C:\Users\Admin\AppData\Local\Temp\bbea22a537d73fb3acbb4d8072aefd00N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\nsgA2B9.tmp\mf.exeC:\Users\Admin\AppData\Local\Temp\nsgA2B9.tmp\mf.exe "C:\Users\Admin\AppData\Local\Temp\nsgA2B9.tmp\inetc.dll"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4724
-
-
C:\Users\Admin\AppData\Local\Temp\nsgA2B9.tmp\ef.exeC:\Users\Admin\AppData\Local\Temp\nsgA2B9.tmp\ef.exe "C:\Users\Admin\AppData\Local\Temp\nsgA2B9.tmp\inetc.dll" -1112⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5d0419b6814f1b8e12b7b70616fedd0c7
SHA1ef5fcbc2fa3623be8cf82def59a696bf946777ec
SHA25614a4c7d96d87cb23038d688e80919d727f0cdb3b51859115f14c0af3248f109c
SHA512d95cf9e3ef07154c83d26d9c57e3d7096f9cd8700aadf72c2e6b33264e46cd6314e072e9f11529431d484d4856f64c611b07c7bbd2bdb197ff593743a1ce1a34
-
Filesize
3KB
MD5068ba6a2cece65f680895ea627f71e39
SHA127070d0fa949a80360426f37b3dfe9eaa0ed66f4
SHA256ef649d2b3daed72b0778ab6b3f22a02e288fd009cf9e7e76eb1991451e580f82
SHA512adf99b31790694d8ad02c56b1cb7c9dadeac49d492225a2d297654bfcd617f3afad23990d1d695fba03af1c355456e2e7c3e972eaa9b5ab1770bbb6eef0e733f
-
Filesize
9KB
MD5225f776172f1baccd2721a6e5d512b36
SHA12dbbc86f7b0285682880a627b56a75de09f4bed6
SHA256ecfcbe30f5b248673f9cbebb734b9981ed14b06380ea787c563d67b30e2d069e
SHA5124b99a5ac68122501a5913cf54bd3ae99d851d57656b0e136980122739cceef739fa2d5ea097f2442068b9489a4c25ea0884653c41d85f27f25996792bf6c21bb
-
Filesize
66KB
MD5b140459077c7c39be4bef249c2f84535
SHA1c56498241c2ddafb01961596da16d08d1b11cd35
SHA2560598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
SHA512fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
2KB
MD5b8a00d99534bf83442b20b2474b767cf
SHA1505d3f6591db0f87a73a0ac820cc2eba5171cfff
SHA256cc6d58b72d806d7f314d31fbea1fd3b72708b2f9dd6d7203e12cf0e076337af6
SHA51275df70621957af1bb2c072ca76cd6f9c5cd92d11e54691daa87d37c0c8bdad5979f8679b49e3e5fc5aa83081ef7b85e6b46393a0877520583d7cca43874ebbd5
-
Filesize
19KB
MD5e93d89074477fec8889ebac9d62b5c39
SHA1efd9720cbfaad9422a7861df1de9a62ade2f01ab
SHA2565d4a0d7b0ffc7c66ed1c82f9a1113171144ce8b4e13b1d32a63633b903681e7f
SHA512e6b208739e9a3c555b7a652a05950e375732352ace80454b50d6f9fd7d39942827ef4c86ed8e707361b299d7a0eaccf368be50eb337739da956537242072f488
-
Filesize
19KB
MD563cba29ea4625660c23cad9e922989f5
SHA154d6113a68222084ffec8e767a755c2d645b26c1
SHA256a2a76f7920005aa914877f2d7e7674e871b4884e17bf34fdf70471bc8fecd1f0
SHA5126dea4fede42dd70c07ebc77ad447b83a05083a9086c79ebacd20740a0924dab2f744c6f5da991ff507a345e24f6565f4a5242a533ae669d7fd308868868de653
-
Filesize
9KB
MD59e58ede648d8d1440df0837ed5876e4d
SHA10752f706596d3fc29efab8b08ebe68dd45ad8d76
SHA2569587850fc6e0cfee023d884e69418219f00726d6d4b029f7d1172d85ec3bae0a
SHA51235222bf5fa64828dfccd4676d6d17c2e3e9f8707e9d2edfb1dde2bb0ac5e0d8cd0f13c4fc5130a8701c1456c1fd0efad2bc5f139f80961f897d585eb1de5ec83
-
Filesize
9KB
MD5189f6fe10648792200f5ba64343274a7
SHA15bb1c9d0b4eee3c64daff88707773f78b60be527
SHA2563f13b20ce35f5893a03f2a823ad4287e52932dedd0a7a23c6f57384f43d583d9
SHA512dda2f0a9376018c3a64340a1996395d4b86ef519cfc60a1a1f641376119662f969ede0155d47c78789a69520842a888eec0ba67fc94fe3e62e2fc8a914f15088
-
Filesize
2KB
MD5224df7127c7ee69e67380eefc983a6ff
SHA1236c342c5bd1f71725534d097fcd8538dd95aa56
SHA2569ca35b84699aff2125cbe775c0731e69dad1d667d3ceec6db59c954dd9c83965
SHA512c238c9fb0285eadd63e9f819b4aead95d88f312ef2a11749a879ba105a0c590e23e2def83f9cd8860744b9307bf12c71fbffbb482fa143e3b13b7934c23df80f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe