Analysis
-
max time kernel
89s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/10/2024, 00:23
Behavioral task
behavioral1
Sample
ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe
Resource
win7-20240903-en
General
-
Target
ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe
-
Size
136KB
-
MD5
da2fe9969f2ba1d2773b88a6bb854b00
-
SHA1
5029bb792b60d969a5a6e75e8edd002c0bbbc9f1
-
SHA256
ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ec
-
SHA512
bb74bb5f98dbf0e0e6848b7e4319434507fd5e3475e52df9a4e1cb681951400af651d2d198a9dafe599a678e7c067a41269ea4b3230f75a93e2fa5e1d9eca95f
-
SSDEEP
1536:P/oEkqfCZ10zcT9Yh8AIXcjyz9cOXfiXGImcatMrsWjcdf6odgR5APfIh:P/5kqCxiXEcO3XfGf2tMUf6odgR5A4h
Malware Config
Extracted
urelas
218.54.47.76
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
pid Process 2900 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 372 biudfw.exe -
Loads dropped DLL 1 IoCs
pid Process 2808 ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biudfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2808 wrote to memory of 372 2808 ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe 30 PID 2808 wrote to memory of 372 2808 ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe 30 PID 2808 wrote to memory of 372 2808 ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe 30 PID 2808 wrote to memory of 372 2808 ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe 30 PID 2808 wrote to memory of 2900 2808 ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe 31 PID 2808 wrote to memory of 2900 2808 ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe 31 PID 2808 wrote to memory of 2900 2808 ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe 31 PID 2808 wrote to memory of 2900 2808 ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe"C:\Users\Admin\AppData\Local\Temp\ab4044f4810ffe851981d6e5d2e9ee27b03bfd166e20c7a5cd74e454021dd5ecN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\biudfw.exe"C:\Users\Admin\AppData\Local\Temp\biudfw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:372
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD50ecda9ecaa423d5a8481985b7d3d5a77
SHA1ecc237c20c234cf9c0e20b39a39ab27244dc7971
SHA256caed69520592602de846673610507a47e22e0fb108e8e88ba1a85b314607f0a9
SHA51282ce4bfc411781d187b6151383064f18e22b37f5f03d783476fed1c8ba74ee38dc74b16badf96961e22d6b63ae31425ae785c17fa3bd5d767ae3b0bd9652fe3a
-
Filesize
340B
MD5a6709a98d02bca4a7a28acd34b19dff7
SHA18d3033337da56879feb4a88efe75e8c7a203303e
SHA2567e10f61899e20ede08faf2500ac46881aaeff68ba3d9e712ebd3c8e277f0eff4
SHA5129e55cc3ce369cba6bf4f280c431f1c35a4f881de7cd1187b62bd6212a663b5357b61d65aaee0cc1fb8765e5d575584fbd6ff42684aa93ddc19f295b448d50edc
-
Filesize
136KB
MD58c4a199906de8d991f8a652dd0add1f0
SHA1a4eed4d4cf900320be96ab27a8ea1a468179d0d9
SHA256888af441737013d7c1fe882666d4d9987e55a71efe9e1884ca082d81d01fbb5b
SHA512df56669bc23874dacc42191acf6ccf41db1ad741410419cc591d05556eef01e75946592ffabbbafb4f5ed1072039eaf4ca4f29e32f5efc614cda39013f9d1208