Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 14:08
Static task
static1
Behavioral task
behavioral1
Sample
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe
Resource
win7-20240708-en
General
-
Target
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe
-
Size
64KB
-
MD5
5b3681183fcac84310c399ddf00064f0
-
SHA1
f4e9b64b88aece299daff568a1c00d8d4404d7af
-
SHA256
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2
-
SHA512
160cfb001d94e566005487236d8455d5a2b5f48e892e97dc8cc8c44f6a009ed7d0739c9d68f5dd3bb3e72ee28ea74bb62d1e200ed9e158a744f1ced82f1feda6
-
SSDEEP
1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTm/o:6bQRSHpAvzyf7MzeTYo
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2252 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 592 biudfw.exe -
Loads dropped DLL 1 IoCs
Processes:
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exepid process 388 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exebiudfw.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exedescription pid process target process PID 388 wrote to memory of 592 388 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 388 wrote to memory of 592 388 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 388 wrote to memory of 592 388 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 388 wrote to memory of 592 388 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 388 wrote to memory of 2252 388 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe PID 388 wrote to memory of 2252 388 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe PID 388 wrote to memory of 2252 388 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe PID 388 wrote to memory of 2252 388 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe"C:\Users\Admin\AppData\Local\Temp\ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:592
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5efd90b3ac908d5482af367de3a82184a
SHA1de9f01d2ed0247b7b347e55c5a09721a60147fb9
SHA25644f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d
SHA5126e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02
-
Filesize
340B
MD552de364334f68538894034967dfa7b25
SHA1d394b860ff927b3ea1504d8bbf73aaa61a450895
SHA25632c8eaa5d1514a1b8920543cbb2e86686812ef8d678ab6a092686398679beb01
SHA51245aeecea873ce57713bc49e65fb398f90a725ad1210e9b31feee0debe6a9df31c9c7345f1f5546b56cfa52c6ed1de0542ebf405aa0352ebed302bbc3b1407de5
-
Filesize
64KB
MD53ed96de26435a95bd724dd8192abeef5
SHA1d9931ad4d4716cae690a269f7048ff579a1a001a
SHA256c50b0d466f3f79b624ef21297e89dfd462d06c54f57c4f9f4b7478a6894b45fb
SHA5126f818ea0d5249969ee9bbab583bfe17b9432cb687279833c13012f67eb38c07fd3322c755a92546b3acd5409d6a352cf17adb0a3ad503b1f26855c5e8904aa3b