bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5c

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe
Size

31KB
MD5

fc5b9ce099f23a7a0440db749e9222d0
SHA1

71ac7bafdc28381d3593d81dc896ca9acb538dfd
SHA256

bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5c
SHA512

010a9f3bd5743cf2b588f95da7bf1b03799dee161d93e3a37de4f3d784da4be917dd927caa8f62c3a17f33042e566f1dc910dfb46703407a5fbb7d1f2f4ce5bb
SSDEEP

768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGbNAKSjNfO+:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xs

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2308	hurok.exe

Loads dropped DLL 1 IoCs

pid	Process
1620	bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hurok.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1620	bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe
2308	hurok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2308	1620	bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe	30
PID 1620 wrote to memory of 2308	1620	bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe	30
PID 1620 wrote to memory of 2308	1620	bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe	30
PID 1620 wrote to memory of 2308	1620	bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe	30

C:\Users\Admin\AppData\Local\Temp\bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe
"C:\Users\Admin\AppData\Local\Temp\bf98143f097729a34059c2764544d7003ccaa87f955e380f66502e8af7c84c5cN.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\hurok.exe
  "C:\Users\Admin\AppData\Local\Temp\hurok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hurok.exe

Filesize
32KB

MD5
ae965c499af8d3da7fc2411b8a5c8bb6

SHA1
6586aa9a744d8079ea8e7faa1fac78dc2f25ac54

SHA256
6bba929d99b9c3b2753e3db0ee7337ddaedf4e08907132a89a7ecb44721f4dce

SHA512
93176888215df32ac04c8ca6f67b7d9d02f5ff2cde708f1e0064cdea7bbd7bd2ee8bee12dc533490bc3adcabb627083bbce7efa7084557700e849f86e823e0fb

Download Submit
memory/1620-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1620-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/1620-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2308-16-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download