Overview

overview

10

Static

static

10

022e3c30a1...66.exe

windows7-x64

6

022e3c30a1...66.exe

windows10-2004-x64

6

4d27dca0a1...ef.exe

windows7-x64

10

4d27dca0a1...ef.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

578a3a7a2b...b3.exe

windows7-x64

10

578a3a7a2b...b3.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

9c4880a98c...82.exe

windows7-x64

10

9c4880a98c...82.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

a1dad4a83d...c4.exe

windows7-x64

10

a1dad4a83d...c4.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

acf1b7d80f...e0.exe

windows7-x64

10

acf1b7d80f...e0.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

cbf31d825a...d2.exe

windows7-x64

10

cbf31d825a...d2.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

db76a117db...12.exe

windows7-x64

10

db76a117db...12.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

e2ffb8aeeb...f6.exe

windows7-x64

10

e2ffb8aeeb...f6.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    139s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06-11-2024 18:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe

  • Size

    834KB

  • MD5

    2c25a0926e5228d2205b3b8c8ef4d7f4

  • SHA1

    5f8a9d364dc3d03a5b11fd5be0629d0fb5a8c409

  • SHA256

    e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6

  • SHA512

    cafe8fae74d414015118b838b5e4b30183733d5e833c5db84a56bd2d5cf728cad08d2bbefbeadc86b15b7dbf6dc25fcabdffa8ff4fb346dc0f66376087a28468

  • SSDEEP

    12288:4EcVL8O4jrAi/X+tuuGK9p3ZWil37Nf5AcXbm8CETY2HhC9nxhnKQqsft+yOY:MLlgAi3dwp3YixJxAsCEhCAQqs0y9

Score
10/10
pseudomanuscryptdiscoveryloader

Malware Config

Signatures

  • Detects PseudoManuscrypt payload 13 IoCs
    loader
  • PseudoManuscrypt

    PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

    loaderpseudomanuscrypt
  • Pseudomanuscrypt family
    pseudomanuscrypt
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:480
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:876
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2572
    • C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe
      "C:\Users\Admin\AppData\Local\Temp\e2ffb8aeeb869fbb3de97b95b0c5c9cf2234d85612ba111115a938c89e4d94f6.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" sqlite.dll,global
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\sqlite.dat
      Filesize

      558KB

      MD5

      bbd4ce7a3b397979f6725781367e2671

      SHA1

      1627f36916b4a3e2384a3aa2b0af35ba9e785093

      SHA256

      c13e0dd5f82062a4659f6fa989b00a2d109644156675aa63e7670288723a9fe4

      SHA512

      b0a5708673f3077eaad552ea664f16b569b653be55865221506b537b41c77ec9b5610d3f67b996e7f2da0bd08da274dc01c9e7db2ce1ed706c18812093d76b65

      Download Submit

    • \Users\Admin\AppData\Local\Temp\sqlite.dll
      Filesize

      52KB

      MD5

      d2c3e38d64273ea56d503bb3fb2a8b5d

      SHA1

      177da7d99381bbc83ede6b50357f53944240d862

      SHA256

      25ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52

      SHA512

      2c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117

      Download Submit

    • memory/876-16-0x0000000000B90000-0x0000000000BDD000-memory.dmp

      Filesize

      308KB

      Download

    • memory/876-12-0x0000000000B90000-0x0000000000BDD000-memory.dmp

      Filesize

      308KB

      Download

    • memory/876-13-0x00000000013E0000-0x0000000001452000-memory.dmp

      Filesize

      456KB

      Download

    • memory/876-17-0x00000000013E0000-0x0000000001452000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-18-0x0000000000110000-0x000000000015D000-memory.dmp

      Filesize

      308KB

      Download

    • memory/2572-32-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-166-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-165-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-163-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-35-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-22-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-23-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-29-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-30-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-26-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/2572-34-0x00000000004A0000-0x0000000000512000-memory.dmp

      Filesize

      456KB

      Download

    • memory/3000-10-0x0000000002110000-0x0000000002211000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/3000-21-0x0000000002110000-0x0000000002211000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/3000-20-0x00000000003F0000-0x000000000044D000-memory.dmp

      Filesize

      372KB

      Download

    • memory/3000-11-0x00000000003F0000-0x000000000044D000-memory.dmp

      Filesize

      372KB

      Download