Analysis
-
max time kernel
119s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-10-2024 15:47
Behavioral task
behavioral1
Sample
890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe
Resource
win7-20240903-en
General
-
Target
890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe
-
Size
507KB
-
MD5
536324c02bf4d7cdde41fb4340308a00
-
SHA1
2dfc4ed8b2e164716c7e10e91f49ac93b3787f50
-
SHA256
890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633f
-
SHA512
88fc0cef9ecd31d544df5d8ed11ce20001659edba3c8232600a5d6dbfda0c198e8d0ffcd6efcd8267ed67646cc0a4b719c7005c3ce6fa49faec41cd9f9205e47
-
SSDEEP
12288:3o7CGWcQSyYI2VrFKH5RBv9AQ1pEDdKo9:3MUv2LAv9AQ1p4dK0
Malware Config
Extracted
urelas
218.54.31.226
218.54.31.165
218.54.31.166
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2708 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
tacyp.exesudok.exepid process 2660 tacyp.exe 2764 sudok.exe -
Loads dropped DLL 2 IoCs
Processes:
890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exetacyp.exepid process 1812 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe 2660 tacyp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
sudok.exe890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exetacyp.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sudok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tacyp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
sudok.exepid process 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe 2764 sudok.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exetacyp.exedescription pid process target process PID 1812 wrote to memory of 2660 1812 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe tacyp.exe PID 1812 wrote to memory of 2660 1812 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe tacyp.exe PID 1812 wrote to memory of 2660 1812 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe tacyp.exe PID 1812 wrote to memory of 2660 1812 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe tacyp.exe PID 1812 wrote to memory of 2708 1812 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe cmd.exe PID 1812 wrote to memory of 2708 1812 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe cmd.exe PID 1812 wrote to memory of 2708 1812 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe cmd.exe PID 1812 wrote to memory of 2708 1812 890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe cmd.exe PID 2660 wrote to memory of 2764 2660 tacyp.exe sudok.exe PID 2660 wrote to memory of 2764 2660 tacyp.exe sudok.exe PID 2660 wrote to memory of 2764 2660 tacyp.exe sudok.exe PID 2660 wrote to memory of 2764 2660 tacyp.exe sudok.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe"C:\Users\Admin\AppData\Local\Temp\890a13c401b03bf011a263efe01994ea75864e01128f87fe0073d1e024f7633fN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\tacyp.exe"C:\Users\Admin\AppData\Local\Temp\tacyp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\sudok.exe"C:\Users\Admin\AppData\Local\Temp\sudok.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD5d940b8bc54d0ba3abac442d2f7d1fcdb
SHA147e0d5e4566da280d4b36363b8a4b51c0a8a83e4
SHA256df9f78b31a8c9eef7ce3d9c65855649386885b783073431425b13b39f6f84555
SHA5124bc26b9765e24a16ae61d0cdfd4231c156202d40f8b774ab8d6aefd8e01136655e1c8547c3de082ec3f1457f0596ecca2aef9ef79fb097ad5c4b50cf1f946335
-
Filesize
512B
MD597620a2735046c3a905c7794fe6095c9
SHA1112def136c555906593a8a3aad81adb895a0000f
SHA256042d2e630c029d4e1c940c1d7d7ec5355046cb214f8b57c44f0c9eb13e9d8f01
SHA51292a1c2efbdb9c63eec2ae618d23ae173d365e6a09fa8822c1c6f743689ad95c926af347c3ac95ed9e22abbe1dfb67f4678d3d0f40de91aa46c82d978f781b3b6
-
Filesize
507KB
MD5c876a0975449818dad1032175469b796
SHA1eba9fee9ec23e9b94ffb7d0581dd3f10288c287c
SHA25632667c0a99729e9e41a2d623ddeac468da02c8b54db4d93d54bf2281ed06f62c
SHA512538fefe93d6f0e4cb1f700a794de81a7fe8967c0db859ca0978d4b235d81e73f042749d96f769581ef094af9ebe013f107c22eef70173890574b06a789d616a5
-
Filesize
172KB
MD53aa86058bb7a8c0f438c9a2788da41e8
SHA118c86abc26e19bb54280a8e0ba6da05305297ecc
SHA2568a185d883482c1b70638957f32024ce775141c2c826561a7a3fe6e5f511d1894
SHA512298ebf77d268ae521dd97eae6e4f56408103d20a2c6968fc094cbee7b142ca9daca20d433cdfff903da23c6d90ff127b89cb900c292120292f45557dba8b23f3