Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/11/2024, 09:11
Static task
static1
Behavioral task
behavioral1
Sample
89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe
Resource
win10v2004-20241007-en
General
-
Target
89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe
-
Size
1.3MB
-
MD5
3033de305199a2dfa2ae15a067686fce
-
SHA1
0359e5dcbd476e7375eb4bf2c7d1e15c98dea27e
-
SHA256
89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83
-
SHA512
ba30241dc4cf660f059cd8e536db0a433ca875ce1d29e02c00cf0d8a569777b05ede0692fddb3d6f0adf26b4b6ea348d8f8eae96037140f25ea6ed3d3c7c7856
-
SSDEEP
24576:Qtb20pkaCqT5TBWgNQ7aySqc44ZcsvHk6A:ZVg5tQ7aySDvY5
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\surmit.vbs surmit.exe -
Executes dropped EXE 1 IoCs
pid Process 2436 surmit.exe -
Loads dropped DLL 1 IoCs
pid Process 1992 89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0008000000016d3a-8.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2436 set thread context of 2624 2436 surmit.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language surmit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2624 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2436 surmit.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2624 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2436 1992 89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe 31 PID 1992 wrote to memory of 2436 1992 89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe 31 PID 1992 wrote to memory of 2436 1992 89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe 31 PID 1992 wrote to memory of 2436 1992 89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe 31 PID 2436 wrote to memory of 2624 2436 surmit.exe 32 PID 2436 wrote to memory of 2624 2436 surmit.exe 32 PID 2436 wrote to memory of 2624 2436 surmit.exe 32 PID 2436 wrote to memory of 2624 2436 surmit.exe 32 PID 2436 wrote to memory of 2624 2436 surmit.exe 32 PID 2436 wrote to memory of 2624 2436 surmit.exe 32 PID 2436 wrote to memory of 2624 2436 surmit.exe 32 PID 2436 wrote to memory of 2624 2436 surmit.exe 32 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe"C:\Users\Admin\AppData\Local\Temp\89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Gammexane\surmit.exe"C:\Users\Admin\AppData\Local\Temp\89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\89cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2624
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD53033de305199a2dfa2ae15a067686fce
SHA10359e5dcbd476e7375eb4bf2c7d1e15c98dea27e
SHA25689cfe67f5db79acfcddfeebe0f984252780a6108b4a425bf878574a3efce6f83
SHA512ba30241dc4cf660f059cd8e536db0a433ca875ce1d29e02c00cf0d8a569777b05ede0692fddb3d6f0adf26b4b6ea348d8f8eae96037140f25ea6ed3d3c7c7856