Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-10-2024 14:02
Static task
static1
Behavioral task
behavioral1
Sample
Rundholterne89.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Rundholterne89.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Levitator/Exungulate.ps1
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Levitator/Exungulate.ps1
Resource
win10v2004-20241007-en
General
-
Target
Rundholterne89.exe
-
Size
870KB
-
MD5
a1e239c4d5116e289ce0597a92844ede
-
SHA1
4562d452ccc32512291c3165a0b9b3c076b28094
-
SHA256
1e507febdd48a2bf2429c8011bd5cbc5c7b018207bdaec87665b8b51fa13d904
-
SHA512
500ddcdc2f1e3ca0da0a43006b99c6e78697433fc0757d25ddff94190dd2d725799faf267efdfacdef758e9024591368454f14025662cc6a1309bce7863494d2
-
SSDEEP
24576:/75JHVcDo1hTW+VeQ9Ke+alCJmvulW6Nd0vd:jDHVUW/VrKe+m7mwMAd
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 2668 powershell.exe 2752 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
powershell.exepowershell.exeRundholterne89.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundholterne89.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 2668 powershell.exe 2752 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2668 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Rundholterne89.exedescription pid process target process PID 2016 wrote to memory of 2752 2016 Rundholterne89.exe powershell.exe PID 2016 wrote to memory of 2752 2016 Rundholterne89.exe powershell.exe PID 2016 wrote to memory of 2752 2016 Rundholterne89.exe powershell.exe PID 2016 wrote to memory of 2752 2016 Rundholterne89.exe powershell.exe PID 2016 wrote to memory of 2668 2016 Rundholterne89.exe powershell.exe PID 2016 wrote to memory of 2668 2016 Rundholterne89.exe powershell.exe PID 2016 wrote to memory of 2668 2016 Rundholterne89.exe powershell.exe PID 2016 wrote to memory of 2668 2016 Rundholterne89.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rundholterne89.exe"C:\Users\Admin\AppData\Local\Temp\Rundholterne89.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VRTLJO96LARSB9E49CUZ.temp
Filesize7KB
MD5773c014601ed6e3ea3755e2ed0113541
SHA1e9451108e944fd29ed1d924eb185f8234e705fae
SHA2569b1a832d6d4bf2644d0f856268d672e7bddebbc3eeae8af7991057cff19501a1
SHA512613658055bbaff398faab59b284bcdab25c972977f8bfd9968cb1bff5cdbc84c13e6db4436841c82298b8fae3b03c1425cb604308fed46aaa4124f7a16165ba6