Overview
overview
10Static
static
517-10-2024...QW.exe
windows7-x64
17-10-2024...QW.exe
windows10-2004-x64
17-10-2024...er.exe
windows7-x64
717-10-2024...er.exe
windows10-2004-x64
717-10-2024...ys.exe
windows7-x64
917-10-2024...ys.exe
windows10-2004-x64
917-10-2024...er.exe
windows7-x64
317-10-2024...er.exe
windows10-2004-x64
317-10-2024...er.exe
windows7-x64
317-10-2024...er.exe
windows10-2004-x64
317-10-2024...re.exe
windows7-x64
1017-10-2024...re.exe
windows10-2004-x64
1017-10-2024...ix.exe
windows7-x64
117-10-2024...ix.exe
windows10-2004-x64
317-10-2024...nt.exe
windows7-x64
1017-10-2024...nt.exe
windows10-2004-x64
1017-10-2024...re.exe
windows7-x64
517-10-2024...re.exe
windows10-2004-x64
517-10-2024...NG.dll
windows7-x64
317-10-2024...NG.dll
windows10-2004-x64
317-10-2024...op.exe
windows7-x64
717-10-2024...op.exe
windows10-2004-x64
717-10-2024...er.exe
windows7-x64
717-10-2024...er.exe
windows10-2004-x64
717-10-2024...an.exe
windows7-x64
317-10-2024...an.exe
windows10-2004-x64
317-10-2024...ie.exe
windows7-x64
517-10-2024...ie.exe
windows10-2004-x64
517-10-2024...oe.exe
windows7-x64
717-10-2024...oe.exe
windows10-2004-x64
717-10-2024...ge.exe
windows7-x64
617-10-2024...ge.exe
windows10-2004-x64
6Analysis
-
max time kernel
93s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-11-2024 22:34
Behavioral task
behavioral1
Sample
17-10-2024 #20/AQW.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
17-10-2024 #20/AQW.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
17-10-2024 #20/Adobe Reader.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
17-10-2024 #20/Adobe Reader.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
17-10-2024 #20/Barys.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
17-10-2024 #20/Barys.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
17-10-2024 #20/Butcher Crypter.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
17-10-2024 #20/Butcher Crypter.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
17-10-2024 #20/Dynamer.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
17-10-2024 #20/Dynamer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
17-10-2024 #20/Explore.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
17-10-2024 #20/Explore.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
17-10-2024 #20/FloodFix.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
17-10-2024 #20/FloodFix.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
17-10-2024 #20/Flyagent.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
17-10-2024 #20/Flyagent.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
17-10-2024 #20/InstallCore.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
17-10-2024 #20/InstallCore.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
17-10-2024 #20/MSRATING.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
17-10-2024 #20/MSRATING.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
17-10-2024 #20/MulDrop.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
17-10-2024 #20/MulDrop.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
17-10-2024 #20/TSULoader.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
17-10-2024 #20/TSULoader.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
17-10-2024 #20/UtilMan.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
17-10-2024 #20/UtilMan.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
17-10-2024 #20/Zombie.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
17-10-2024 #20/Zombie.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
17-10-2024 #20/app stroe.exe
Resource
win7-20241023-en
Behavioral task
behavioral30
Sample
17-10-2024 #20/app stroe.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
17-10-2024 #20/assemblychange.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
17-10-2024 #20/assemblychange.exe
Resource
win10v2004-20241007-en
General
-
Target
17-10-2024 #20/Zombie.exe
-
Size
37KB
-
MD5
3766e7d299fd60b99b57a8f23e3ecf80
-
SHA1
634ac90a3e3e964e75e52071fefb96b51c824611
-
SHA256
d091ab54c8cb7db4189a8556381b8ad9d5717be97be373caa18adaa3476eaa40
-
SHA512
06f65b5ddc6e914ef844a71925c866bcb6e216dd5144bb28a7361801e8b555c65d327ce9adc18cb791a5a93f53ac9b1fe26bf68ad9b403a4128eb27a1c0c70d1
-
SSDEEP
384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9T6My2X:kBT37CPKKdJJ1EXBwzEXBwdcMcI9daFo
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral28/memory/2988-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral28/memory/2988-1-0x0000000000400000-0x000000000040A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Zombie.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe