Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 14:13
Static task
static1
Behavioral task
behavioral1
Sample
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe
Resource
win7-20240729-en
General
-
Target
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe
-
Size
64KB
-
MD5
5b3681183fcac84310c399ddf00064f0
-
SHA1
f4e9b64b88aece299daff568a1c00d8d4404d7af
-
SHA256
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2
-
SHA512
160cfb001d94e566005487236d8455d5a2b5f48e892e97dc8cc8c44f6a009ed7d0739c9d68f5dd3bb3e72ee28ea74bb62d1e200ed9e158a744f1ced82f1feda6
-
SSDEEP
1536:6bQx5oPsr2vFxDPhAvzgAQzFZ77MzeTm/o:6bQRSHpAvzyf7MzeTYo
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2544 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2052 biudfw.exe -
Loads dropped DLL 1 IoCs
Processes:
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exepid process 2580 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exebiudfw.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exedescription pid process target process PID 2580 wrote to memory of 2052 2580 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 2580 wrote to memory of 2052 2580 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 2580 wrote to memory of 2052 2580 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 2580 wrote to memory of 2052 2580 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe biudfw.exe PID 2580 wrote to memory of 2544 2580 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe PID 2580 wrote to memory of 2544 2580 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe PID 2580 wrote to memory of 2544 2580 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe PID 2580 wrote to memory of 2544 2580 ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe"C:\Users\Admin\AppData\Local\Temp\ec95dfc127a1053672f3f078925436c9d3c52e72e6ea6678607f4a43bffc06d2N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2052
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5f13df147bd81a358f5d3b17c03c8f509
SHA16e6844158852e316ac947c446ad8e0a1d2c9dd26
SHA2568ea6308f4d5f7b4b4f8258e66756851e968dc5f3bb3d52bfaa3e71eba4b5c6d4
SHA512cae55d43ca5de89973d110335460edec5b76dfc55b313c5920da9c0f9b9117e727f989b47ff922d25d27fa5912fab3a4265ce622012eb680bb4a1e9b52d0ca5f
-
Filesize
512B
MD5efd90b3ac908d5482af367de3a82184a
SHA1de9f01d2ed0247b7b347e55c5a09721a60147fb9
SHA25644f3db1bb73bb207a88008ae28d0399f888b5714ccccb2056f4148b4455e693d
SHA5126e3355f895af1d81887d5750033c5a139e4a0e1c2c928aeef1fd37f9c191e754b1f524d252c229ea5e744dbef4dd0a8240d9d3443651d42de198e82a197afb02
-
Filesize
340B
MD552de364334f68538894034967dfa7b25
SHA1d394b860ff927b3ea1504d8bbf73aaa61a450895
SHA25632c8eaa5d1514a1b8920543cbb2e86686812ef8d678ab6a092686398679beb01
SHA51245aeecea873ce57713bc49e65fb398f90a725ad1210e9b31feee0debe6a9df31c9c7345f1f5546b56cfa52c6ed1de0542ebf405aa0352ebed302bbc3b1407de5