Resubmissions

13-11-2024 23:34

241113-3kmbta1eqc 10

13-11-2024 22:28

241113-2dpb6azme1 10

11-11-2024 05:34

241111-f9w6zstjbz 10

11-11-2024 03:05

241111-dlmlja1jbx 10

11-11-2024 03:00

241111-dhk9aszrdz 10

08-11-2024 08:59

241108-kx2cdssjdk 10

08-11-2024 08:55

241108-kvvf3aymdw 10

Analysis

  • max time kernel
    143s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11-11-2024 03:00

General

  • Target

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

  • Size

    669KB

  • MD5

    ead18f3a909685922d7213714ea9a183

  • SHA1

    1270bd7fd62acc00447b30f066bb23f4745869bf

  • SHA256

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

  • SHA512

    6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

  • SSDEEP

    6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\d45cc308-a3ae-464f-882d-06d35d9e7176" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:2560
    • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
          "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2824 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1080
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2820 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    1KB

    MD5

    67e486b2f148a3fca863728242b6273e

    SHA1

    452a84c183d7ea5b7c015b597e94af8eef66d44a

    SHA256

    facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

    SHA512

    d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

    Filesize

    436B

    MD5

    971c514f84bba0785f80aa1c23edfd79

    SHA1

    732acea710a87530c6b08ecdf32a110d254a54c8

    SHA256

    f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

    SHA512

    43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    174B

    MD5

    af444f0e6b36a9a439adf74a51f07da1

    SHA1

    8cc1f36837c6d4318c085bde6f8c01d8b713e01f

    SHA256

    183b1f4a712719bfd6129ba0dae1377e312525c0f36e614547164554a7a5fbd6

    SHA512

    2c2a55ae0b0a50b74378539de5dd02b9097f152bbb1b1d8fa474f212c81d65c3ef87bac192893b1586909f7d609689f919b5b572d276900c8d4c6162ed1eaccb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aba60899c90ff6f025e616a12ed6d980

    SHA1

    86a3113b5ffcd31923066e3cd3a1da8ed10e1510

    SHA256

    c21cbc74b58d7666fb29a416a2c055fd83464ab601df8f68da8cd628eb25837c

    SHA512

    b4fa2c2cea78bb8c1dd23becaf048bd5da1eca36f20370afb64f25b42911d957fe3513007e37df2cd29b932571bf66bc3ff25e5b070604d81ed693143fd98401

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

    Filesize

    170B

    MD5

    5c79b387e315bbe998b977cfc7936868

    SHA1

    33dc08c2b6afb09471d6ed183441c9eff08a9e26

    SHA256

    2fe736292212833141022e21bf986a83af784480351c7477f5548f36e743072b

    SHA512

    325df0b552434ec047ff35c918c13cbc20b66016ed48ed6c4510f9f6263792633ac786cb4366b2b74ba5b7e9b428b1d97070314f6da19967c74308239f2bceda

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    5fc6a81de46daf2a7c541713ec1064b4

    SHA1

    bc4fa77b32a8dfaeadeffb1f661459edf0667bae

    SHA256

    477175b80cb8859121ae9a033df4e0f812f318e349915b207d1169e579f32d2d

    SHA512

    be8867f5ae949132cbe6f93181bb04539f11c9dd6191a0a75c8b1761ca689ff9cd891b1f81170d708c12d2700d8dbd0fd2143799564aabdf086e8fe156f10d32

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    3d0e2e17569ab8cf67f80ff82bd874cf

    SHA1

    e41f2880d25023c20330739a683551a356622af9

    SHA256

    f067b2e97c0aa7eba6dbdadef31c33ca91a92b8ffbdfb1301fb3be0377fb6077

    SHA512

    bbee88f97881c139aca8f5edd6a9a72b4b8c728f580236a1d0b7be7b11102634b8b8479717761f46d723131fbcfbfc68556a125f58d1945ac5bfb8cd5482440f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\geo[1].json

    Filesize

    541B

    MD5

    839cfc9db79e4d5d1472cc1463892ee9

    SHA1

    28a5d76254cd1ca8dee1a9b91cede46dff570ff8

    SHA256

    2a8b99980790ccf38faea6d4e1c0a3f2292a1a3e02a77d257381c24d95eb23c7

    SHA512

    b4ecf3ce9795ce871d6a409461c97091b9d4f14a82f6b6c7bf65955fead9a7b746e38b3ed88ab61349b5ced58c80540deacc7dfa800e9d6ff9d04fd89a16a825

  • C:\Users\Admin\AppData\Local\Temp\Cab963.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar9252.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\d45cc308-a3ae-464f-882d-06d35d9e7176\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

    Filesize

    669KB

    MD5

    ead18f3a909685922d7213714ea9a183

    SHA1

    1270bd7fd62acc00447b30f066bb23f4745869bf

    SHA256

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

    SHA512

    6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

  • memory/1080-91-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2808-23-0x0000000003E20000-0x0000000003EC9000-memory.dmp

    Filesize

    676KB

  • memory/2808-26-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2808-3-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2808-27-0x0000000000600000-0x0000000000700000-memory.dmp

    Filesize

    1024KB

  • memory/2808-2-0x0000000000600000-0x0000000000700000-memory.dmp

    Filesize

    1024KB

  • memory/2808-28-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2808-0-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2820-48-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2820-49-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2820-46-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2820-31-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2820-30-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2820-25-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2820-93-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2824-76-0x0000000003650000-0x00000000036F9000-memory.dmp

    Filesize

    676KB

  • memory/2824-78-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2824-92-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB

  • memory/2828-90-0x0000000000400000-0x00000000004A9000-memory.dmp

    Filesize

    676KB