Analysis
-
max time kernel
69s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22-10-2024 12:08
Static task
static1
Behavioral task
behavioral1
Sample
Fignen234.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Fignen234.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Fignen234.exe
-
Size
529KB
-
MD5
f71ca6bd7ede3a21cf722ffe4112e594
-
SHA1
e45d7fb3c3f224c47ad6e26b101fef648aa22b63
-
SHA256
feaabdf9165e508294f7006308b85802672ee6d7fac58ce4b3c92f6cb63334cc
-
SHA512
ab3d60930e10bc49fd0c9cf54215ba59641238cd486bf796000e14b4605de2373441f5ec76777d14e943cf1f9bc54ff30c1c2de829b19b941fd639da77cc620e
-
SSDEEP
12288:DMUVNauikWJNEay+ZfXDKqdMN559ClR9FzS/s+ZHmkHN3HiPCpfBVx:I/YW++ZfX72N559JHnHpHiwV
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
Processes:
Fignen234.exepid Process 2300 Fignen234.exe 2300 Fignen234.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Fignen234.exepid Process 2448 Fignen234.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Fignen234.exeFignen234.exepid Process 2300 Fignen234.exe 2448 Fignen234.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Fignen234.exedescription pid Process procid_target PID 2300 set thread context of 2448 2300 Fignen234.exe 29 -
Drops file in Windows directory 1 IoCs
Processes:
Fignen234.exedescription ioc Process File opened for modification C:\Windows\resources\Trnregimenternes\totalsanerende.Obs202 Fignen234.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Fignen234.exeFignen234.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fignen234.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fignen234.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Fignen234.exepid Process 2448 Fignen234.exe 2448 Fignen234.exe 2448 Fignen234.exe 2448 Fignen234.exe 2448 Fignen234.exe 2448 Fignen234.exe 2448 Fignen234.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Fignen234.exepid Process 2300 Fignen234.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Fignen234.exedescription pid Process procid_target PID 2300 wrote to memory of 2448 2300 Fignen234.exe 29 PID 2300 wrote to memory of 2448 2300 Fignen234.exe 29 PID 2300 wrote to memory of 2448 2300 Fignen234.exe 29 PID 2300 wrote to memory of 2448 2300 Fignen234.exe 29 PID 2300 wrote to memory of 2448 2300 Fignen234.exe 29 PID 2300 wrote to memory of 2448 2300 Fignen234.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"C:\Users\Admin\AppData\Local\Temp\Fignen234.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
738B
MD547674f72384fda8e1c1bb43c145131ef
SHA178203849143cb267becafb5e4f1306297536a87e
SHA2569bf1aafb541d22dff36de2b2ff73241f395c77b59e77c3cffc141e17293a3540
SHA5120e0935f8e695e48a16f79b34d9af2fdea3a5e6958e16f034c55f61a71982735c54c770dafefac0b666a26665eec25fbcf38e468d6cc243995a37d1b1a90d894d
-
Filesize
11KB
MD5cf85183b87314359488b850f9e97a698
SHA16b6c790037eec7ebea4d05590359cb4473f19aea
SHA2563b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
SHA512fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b