Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-10-2024 14:29
Behavioral task
behavioral1
Sample
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe
Resource
win7-20240903-en
General
-
Target
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe
-
Size
159KB
-
MD5
3a746d12104aa8da6a56bc39bfbf9400
-
SHA1
6e923f8079882c319188440a10bfd1b77d2b15d4
-
SHA256
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85
-
SHA512
349a972eb610164060d4671a2f6197dbea59d5355c96c7c3760eef147d88bc2fb6b5f10954d2ad9cb98a8da38e2b2e083fbe22daabbe5391c767bb403da0e398
-
SSDEEP
3072:yp56zRJ83+OJ7NoGvdwWy6k04yW/KR0Yi:yOzRWu27dlOd5/Yi
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2992 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
biudfw.exepid process 2936 biudfw.exe -
Loads dropped DLL 1 IoCs
Processes:
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exepid process 1684 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
biudfw.execmd.exe0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exedescription pid process target process PID 1684 wrote to memory of 2936 1684 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe biudfw.exe PID 1684 wrote to memory of 2936 1684 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe biudfw.exe PID 1684 wrote to memory of 2936 1684 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe biudfw.exe PID 1684 wrote to memory of 2936 1684 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe biudfw.exe PID 1684 wrote to memory of 2992 1684 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe cmd.exe PID 1684 wrote to memory of 2992 1684 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe cmd.exe PID 1684 wrote to memory of 2992 1684 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe cmd.exe PID 1684 wrote to memory of 2992 1684 0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe"C:\Users\Admin\AppData\Local\Temp\0db1026131fbe525b1bfe8d94a76e013281a5d14195df528784b3a6719d8ea85N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5ac5e84ed8031d66a9fcd5e472ba8091b
SHA106303add604104d6abbb69458f89773c066b470c
SHA2563a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5
SHA5127bf829102a70a1304dae435b8ae3c9ef9a925af7e995fe381d80730f4f702e1fd2a0a1b6a3a4b4667925f5bb95c897166a8fc0f52d3171d9cdba0bf09b53f152
-
Filesize
340B
MD5809642777c7cdfbb0dd067abefc87083
SHA10f6cf2cbc0d15360a5db30d362c124f255e53e6f
SHA2564a53c8eadfbed7dd4c5caafa52c9b4fa6dcbe86cd3144649d2e7cebadf8b3939
SHA51295ddbded3f32c4a7f8e97f9a3c65425e30b4c056ef1ff97825f5b634b3a7c47d50aa53e1a63fcdcf3e8c3cbacced4fd1862537202faeb7db1fb8e86901a94335
-
Filesize
159KB
MD5092d11393f381e45e6b857d038f5fc35
SHA17f9f3d553d7513f1cf6b0353c76333b7c40e06c2
SHA256585a7db88dd016a873629f9f32f53fe5ce69ebfdfffa14763b05753f3a1c6faa
SHA5126f23c464eb74dbfacecb8576b689199b647c4d640227ee73797665f0380c4df0e2e38bc3095b104e2e6e0144be61c4e8de484faacada5efc48c60bc55aeb504a