Analysis
-
max time kernel
18s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 15:30
General
-
Target
Drk's ByfronFucker.exe
-
Size
7.5MB
-
MD5
0f821f7d9691de0b4710df98a967602f
-
SHA1
d31fd82016e42e01e72cf0d7ba72ff241ba85a57
-
SHA256
a78367207efa009e8b0287d75dbb1b83cf98eaf3ec7c241dc21ddd34b5545015
-
SHA512
68c577d2bc9d61c36825aa810105d723b48853d23fa4c5345010ac698ce76d9773a573dcc735dc6d7e69122e5c81ed6806d4cd220f0d06af4c64277e3a75b1d8
-
SSDEEP
196608:gadwYejzUwMvcOyk8q6X1+e1Y2n+TblT6vdKFc+yr0:gqy0woykyo2nedudKFHg0
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Drk's ByfronFucker.exe"C:\Users\Admin\AppData\Local\Temp\Drk's ByfronFucker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Drk's ByfronFucker.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\NQvyRtQki2492290214446157442.tmp3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1728574256616.tmp4⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1728574256616.tmp" /f"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1728574256616.tmp" /f5⤵
- Adds Run key to start application
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD56428f5be0ebdafd804f6bd192e96cd65
SHA1686b76ed43c9bd3f0356add9e5689c95f340f84c
SHA2565d8341a5e0a9d17ad9e32b96fd973930005330a7f2156366838711aff0bafda0
SHA51216d485c6381d1b3738def7ef881481b9bbfab9f319722faa5a4e3acbfd87137a260dd9365f0853b42c74c50a9d459795df22901feac0dccda791bf0340a78f6c
-
Filesize
710KB
MD5bc9263297a02b664fe5795024e263c63
SHA1c5e76f7b0ab987612513914ee43b66e215a896f2
SHA2563e7d4c4b8eb1f2329feef957ffe55273b2e8d39ca06e44e2bda9fb18db8b8bf8
SHA5121c3f8bd56b63325f1c67f83e8aa873479f8e7d3da27a2d7314f77d666d72967f1eef00130007eb5e61e015d47371cfa19e99db01a7c2b9fb1c83129cfeead17c
-
Filesize
69KB
MD5bb4f657a48364b32193e071e62ed8260
SHA1f8fbe5bac1358147396db641873ef04865635b0f
SHA256fa5885d2d6b6a79b12edcb11e0a4812ef6c374bda704c3db3a4a29b97c4417f2
SHA512b47328a0d85f2a44853a9c521fe9b16a6d80b420290e3320bda88e01b9d1ce4ae322c26ba4c507b00aaa3abdb6c1358c3ea412c7c9369b4eae4fea1397d3fb39
-
Filesize
69KB
MD513053c23f57d19a9a1b969b398fd2d6b
SHA1f16bb4d479081e082b90e08a4414905838ee7994
SHA256d3af4916973b795c65b9568a58fd3a6e34e89d73195f320a95804270b26c6c6c
SHA512967bb6af5dc61b51ded059ec6505bbfd69f6dbe026a6ab1c75bc2f1de390300edfde44097694012a1bedc7bbf02076852cd87905a780425b28cab9f165125b42
-
Filesize
25KB
MD518d5848fadb34ac7e931ee5b70e5a29c
SHA1071eb641359bde6d4e5306f85af03373b1d685ef
SHA25648def87b1528bb422ee4c59f541058c7ba115dc358c6b9e20fa94163e7840046
SHA51224d1e32d9ccb0c08cbc55c2a1628f791e2a2477896d37f7af340ea9dc44159bc0ac5768a0a2ba92a81a475c3a4803be6fc96a795a3bf34eecc79c6736bcd499d
-
Filesize
357KB
MD5dad976fafd111ceedc7a473932e9da8f
SHA13c0e8e7fcbc854a87219fbbfd181c2cc76018144
SHA256f61949c469c54a5f4e5a8e1668255b919ee1237f1e568acf4127dda0abcdc9a8
SHA51264801d4d34f130b5ee33d2df3a266e2aed981265d13c6552ab73418471398c49cab9a617647b64298c1de432d078f1a7b830d4330980e7ef10dd15a1d18bda11
-
Filesize
446KB
MD578b8212a157e985fa9d9ee9eaab033bd
SHA10c9b501520c20055ba77bbd8cae4895fcb1cfa40
SHA2561cbc8a197aea7eee710735a57a8cae6c0953ad1fe2cb6e17c2e5afebeb93b5ec
SHA512180dd20b04643d42195a30c28d455c923f395977f7dcb66b1ace85e99c1e3c00906542221092bf6d5465a5fc451d7523df862ab2bc050da3a136a6f635706d80
-
Filesize
45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
316KB