Overview

overview

9

Static

static

3

36c497ce1c...28.exe

windows7-x64

9

36c497ce1c...28.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    60s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 19:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    36c497ce1c187e8e5a5f659a428c2886768f3953d90fa7a518a68bda4b264728.exe

  • Size

    518KB

  • MD5

    5437d6a05afdc45c48dec6bfac4e60c2

  • SHA1

    3e5e57705553f6e015e200c22c6136a41119eac1

  • SHA256

    36c497ce1c187e8e5a5f659a428c2886768f3953d90fa7a518a68bda4b264728

  • SHA512

    c976b3be0b2229ce03b759db5ea47d11519637dbc45e11252f88d91875b184e28e992fd2815ba9444945ad31b4e67f29c6381263975735ded70800729b58df6b

  • SSDEEP

    6144:Reynlu0+eH9Bpox4I3ANJuBN0PDGxWSqqcfrj8XzL/3upuqs8j8IvwvWGEuTt3ny:Nnb9ZNJuzVrcX8GW8j5veWpuTtMMo

Score
9/10
discoveryransomware

Malware Config

Signatures

  • Renames multiple (576) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36c497ce1c187e8e5a5f659a428c2886768f3953d90fa7a518a68bda4b264728.exe
    "C:\Users\Admin\AppData\Local\Temp\36c497ce1c187e8e5a5f659a428c2886768f3953d90fa7a518a68bda4b264728.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1840
    • C:\Users\Admin\AppData\Local\Temp\_MpCmdRun.exe
      "_MpCmdRun.exe"
      2⤵
      • Executes dropped EXE
      PID:1872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp
    Filesize

    62KB

    MD5

    ae88f212c710583cb0b8b57c596f1286

    SHA1

    105af363b90054a037539f37ef9408edab0c2066

    SHA256

    f66de566e82ccd65252e417cac1345e6c96ba46e0c06e1028384c75a9b4a2602

    SHA512

    34fadd54ff43550c5cfa13bf9d58d7585692462993e8f2fecb3b2f55d2f9ceff9c56051e043a791d8a856cf8a78b58753347b1600a3567541a6dbca8e1b191ca

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MpCmdRun.exe
    Filesize

    456KB

    MD5

    dd8e8a4e0b8bae088dca303b78e12c77

    SHA1

    510a231c1ce12bcaee6f8d172c38ec06e524a795

    SHA256

    17ee13b7e86069505ca5b56099336a0980173c3892aee3d108f9497955e40c62

    SHA512

    9ccdbc4ff8ed0ef6aaa9120060028d8d45642d59344217d905134ea1ce416584bc4c86daa3720adc08b98c78e07cc295d16b77507a0fb56c96f464171756e0db

    Download Submit

  • C:\Windows\SysWOW64\Zombie.exe
    Filesize

    62KB

    MD5

    5af944cf740d2192d144419d30762476

    SHA1

    363dd67cf6512196afed71bd203f28f14e10a69e

    SHA256

    d450ad7ccae673bd9f292caf4dc4b78d20b8a133036bb931cf5fa8d24e1163a5

    SHA512

    b29406b5c0125c408f600ef91079be3e0239397ba664227e139e44946f828c35485ea0af3a5423f84c0818e03bc698b4c9b0e3b5d303d86ad0e632d26264a148

    Download Submit