Overview
overview
10Static
static
5#10302024.exe
windows10-ltsc 2021-x64
7102924_5830760.exe
windows10-ltsc 2021-x64
10103024_37663.exe
windows10-ltsc 2021-x64
7240827 YON...SS.exe
windows10-ltsc 2021-x64
8AWB #281024..scr
windows10-ltsc 2021-x64
8EE85716273pdf.vbs
windows10-ltsc 2021-x64
10Produccion.exe
windows10-ltsc 2021-x64
10Quotation.exe
windows10-ltsc 2021-x64
10報價請�...��.vbs
windows10-ltsc 2021-x64
8Analysis
-
max time kernel
98s -
max time network
140s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
06-11-2024 02:10
Static task
static1
Behavioral task
behavioral1
Sample
#10302024.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
102924_5830760.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
103024_37663.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
240827 YONG SHUN - GMDSS.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral5
Sample
AWB #281024..scr
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral6
Sample
EE85716273pdf.vbs
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral7
Sample
Produccion.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral8
Sample
Quotation.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral9
Sample
報價請求 - 樣本目錄.vbs
Resource
win10ltsc2021-20241023-en
General
-
Target
#10302024.exe
-
Size
1.5MB
-
MD5
432523c2a91f208ce00e9aa553c25883
-
SHA1
00fc307df8d7970dc4ca4c9f786d025d1032aeee
-
SHA256
a131f667cc1c8ab17777294ffc556a8b45dd726452ccc10d716daa39d256d3a6
-
SHA512
7a1e1f31b79bb9eff8a7463b7bb40aeb837584c990bce85b6189c07597c6bc12e17fecd1c09f53b163640b9f5e36cf6968c19499a7bf8a6d9210c9523361b31d
-
SSDEEP
24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8aIkLEdvEkGI66/aVKJvoWXrVTSNa:NTvC/MTQYxsWR7aIkwdvEkS6NlrV6
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asset.vbs asset.exe -
Executes dropped EXE 1 IoCs
pid Process 4400 asset.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x002800000004505b-5.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4400 set thread context of 3940 4400 asset.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language #10302024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asset.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe 3940 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4400 asset.exe -
Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe -
Suspicious use of SendNotifyMessage 20 IoCs
pid Process 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 624 #10302024.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe 4400 asset.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 624 wrote to memory of 4400 624 #10302024.exe 87 PID 624 wrote to memory of 4400 624 #10302024.exe 87 PID 624 wrote to memory of 4400 624 #10302024.exe 87 PID 4400 wrote to memory of 3940 4400 asset.exe 90 PID 4400 wrote to memory of 3940 4400 asset.exe 90 PID 4400 wrote to memory of 3940 4400 asset.exe 90 PID 4400 wrote to memory of 3940 4400 asset.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\#10302024.exe"C:\Users\Admin\AppData\Local\Temp\#10302024.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\phytographic\asset.exe"C:\Users\Admin\AppData\Local\Temp\#10302024.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\#10302024.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5432523c2a91f208ce00e9aa553c25883
SHA100fc307df8d7970dc4ca4c9f786d025d1032aeee
SHA256a131f667cc1c8ab17777294ffc556a8b45dd726452ccc10d716daa39d256d3a6
SHA5127a1e1f31b79bb9eff8a7463b7bb40aeb837584c990bce85b6189c07597c6bc12e17fecd1c09f53b163640b9f5e36cf6968c19499a7bf8a6d9210c9523361b31d