Overview
overview
10Static
static
3028d53f522...fa.exe
windows7-x64
10028d53f522...fa.exe
windows10-2004-x64
10Bot_Checker.exe
windows7-x64
3Bot_Checker.exe
windows10-2004-x64
7Uninstall.exe
windows7-x64
3Uninstall.exe
windows10-2004-x64
7Versium.exe
windows7-x64
7Versium.exe
windows10-2004-x64
7VersiumRes...it.exe
windows7-x64
10VersiumRes...it.exe
windows10-2004-x64
10VersiumRes...it.exe
windows7-x64
1VersiumRes...it.exe
windows10-2004-x64
1Versiumresearch.exe
windows7-x64
6Versiumresearch.exe
windows10-2004-x64
6Analysis
-
max time kernel
20s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 11:14
Static task
static1
Behavioral task
behavioral1
Sample
028d53f5224f9cc8c60bd953504f1efa.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
028d53f5224f9cc8c60bd953504f1efa.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Bot_Checker.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Bot_Checker.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Uninstall.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Versium.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
Versium.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
VersiumResearch32bit.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
VersiumResearch32bit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
VersiumResearch64bit.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
VersiumResearch64bit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Versiumresearch.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Versiumresearch.exe
Resource
win10v2004-20241007-en
General
-
Target
Bot_Checker.exe
-
Size
56KB
-
MD5
391ca27e1e5cc0da88d1fcc8df1d0d85
-
SHA1
25bd7c5b7d88bcd01610226fccb0910b48dc1eee
-
SHA256
a9ee4862c1e7931ef8366b090ac1f3212e79cc17d7737f537978d9a3fb0c5ef1
-
SHA512
2dbb84eb664798766a669c7d407be76d5154bd7d0b99f2c2371ad0ae3e1124605df0771b228f7a3406f023fa9cbba3022afb5b48207cf1eb14d94cda7a5117f9
-
SSDEEP
768:dQR+JJlY3yGJxNojkTnJI6TWzzejkZy/xbD9BxufhqXKClqp9:NAoITdT0Zy5bZXYmlqp9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Bot_Checker.exeBot_Checker.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bot_Checker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bot_Checker.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Bot_Checker.exedescription pid process target process PID 1600 wrote to memory of 2524 1600 Bot_Checker.exe Bot_Checker.exe PID 1600 wrote to memory of 2524 1600 Bot_Checker.exe Bot_Checker.exe PID 1600 wrote to memory of 2524 1600 Bot_Checker.exe Bot_Checker.exe PID 1600 wrote to memory of 2524 1600 Bot_Checker.exe Bot_Checker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe"C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe"C:\Users\Admin\AppData\Local\Temp\Bot_Checker.exe" -a2⤵
- System Location Discovery: System Language Discovery
PID:2524
-