008e3411cfd9d08d53a77da0cddaf2986c7e29a40ef12914edfa91b2322ae451

Analysis

max time kernel
134s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13/09/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

робит.exe
Size

464KB
MD5

fad5ce6971513fa62e138ce00a9b7797
SHA1

ab9be0ca2dc5926c87770c6e83f9b61d68323ba4
SHA256

008e3411cfd9d08d53a77da0cddaf2986c7e29a40ef12914edfa91b2322ae451
SHA512

aeede1191a8c7971d9b589ebd4509ae5d001ca08a6d6e5dd9df33d877ab72c29118eb7074a7dc9608bac00e08279921dfcd551dfa4cca65d6470a78af9ea6b3c
SSDEEP

12288:UCQjgAtAHM+vetZxF5EWry8AJGy0wT+t1k:U5ZWs+OZVEWry8AFUk

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
96	RunSVhost.exe
3848	RunSVhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\RunDlllModule = "C:\\Users\\Admin\\AppData\\Roaming\\RunSVhost.exe"	reg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_240609031	робит.exe
File created	C:\Windows\components.bat	робит.exe
File opened for modification	C:\Windows\components.bat	робит.exe
File created	C:\Windows\RunSVhost.exe	робит.exe
File opened for modification	C:\Windows\RunSVhost.exe	робит.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunSVhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunSVhost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
96	RunSVhost.exe
3848	RunSVhost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4944	4676	робит.exe	73
PID 4676 wrote to memory of 4944	4676	робит.exe	73
PID 4676 wrote to memory of 96	4676	робит.exe	76
PID 4676 wrote to memory of 96	4676	робит.exe	76
PID 4676 wrote to memory of 96	4676	робит.exe	76
PID 4944 wrote to memory of 4652	4944	cmd.exe	77
PID 4944 wrote to memory of 4652	4944	cmd.exe	77
PID 4944 wrote to memory of 3848	4944	cmd.exe	78
PID 4944 wrote to memory of 3848	4944	cmd.exe	78
PID 4944 wrote to memory of 3848	4944	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\робит.exe
"C:\Users\Admin\AppData\Local\Temp\робит.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\components.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v RunDlllModule /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RunSVhost.exe"
    3⤵
    - Adds Run key to start application
    PID:4652
- - C:\Users\Admin\AppData\Roaming\RunSVhost.exe
    C:\Users\Admin\AppData\Roaming\RunSVhost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3848
- C:\Windows\RunSVhost.exe
  "C:\Windows\RunSVhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:96

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\RunSVhost.exe

Filesize
84KB

MD5
3b5bc5f92b9d255712e426ca0bcd1f8a

SHA1
ed8f382205916e99e5ce61bf73c2f6112b37306b

SHA256
adce9a3a0cd73fb0e20df10178a6c9560eb73908e2b97e227a111c8c11a211a2

SHA512
a64dc42a88ac51a430c3cf0bea0d2f4be6da6b1982dfea10b418d3fe430d854a596fc5f116a51860561257ce70d71f30b9e021d372631df65a1c6829eaf47e4c

Download Submit
C:\Windows\components.bat

Filesize
239B

MD5
674a7fe16ac8d299adb10ed11db8ee06

SHA1
688192d79e16eacf918f749f053deaf0d8913dee

SHA256
00c6a3d2142affaad81d6b75348093342b919c507281dd1d582b44bfc60d9791

SHA512
4380ac84ab25b18414ecfe011644db94fa01a37e7726bb671cc1328f9525392bc82f081c4186abde345611f679138904afb7c28f0fb714324bdff6ea93b2525d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads