Overview
overview
10Static
static
10malware/EinTT.exe
windows7-x64
10malware/EinTT.exe
windows10-2004-x64
10malware/fox.exe
windows7-x64
3malware/fox.exe
windows10-2004-x64
3malware/guJPO.exe
windows7-x64
10malware/guJPO.exe
windows10-2004-x64
10malware/loader1.exe
windows7-x64
10malware/loader1.exe
windows10-2004-x64
7dnjdbaa.exe
windows7-x64
3dnjdbaa.exe
windows10-2004-x64
3malware/regasm.exe
windows7-x64
10malware/regasm.exe
windows10-2004-x64
10malware/vbc.exe
windows7-x64
10malware/vbc.exe
windows10-2004-x64
7rywcikv.exe
windows7-x64
3rywcikv.exe
windows10-2004-x64
3malware/vbc1.exe
windows7-x64
10malware/vbc1.exe
windows10-2004-x64
7eblupydfzx.exe
windows7-x64
3eblupydfzx.exe
windows10-2004-x64
3malware/vbc2.exe
windows7-x64
10malware/vbc2.exe
windows10-2004-x64
7ioatgumevw.exe
windows7-x64
3ioatgumevw.exe
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:32
Behavioral task
behavioral1
Sample
malware/EinTT.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
malware/EinTT.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
malware/fox.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
malware/fox.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
malware/guJPO.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
malware/guJPO.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
malware/loader1.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
malware/loader1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
dnjdbaa.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
dnjdbaa.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
malware/regasm.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
malware/regasm.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
malware/vbc.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
malware/vbc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
rywcikv.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
rywcikv.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
malware/vbc1.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
malware/vbc1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
eblupydfzx.exe
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
eblupydfzx.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
malware/vbc2.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
malware/vbc2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
ioatgumevw.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
ioatgumevw.exe
Resource
win10v2004-20241007-en
General
-
Target
malware/vbc1.exe
-
Size
233KB
-
MD5
9a438bc1d2e08161d0fade11ff6c39bf
-
SHA1
9522e356bba95728046ced9c7071b58cdb5a6d76
-
SHA256
b77f6786b940f40b4eebd492b925ad174b28b50fbf9ead3a1b1000189b530704
-
SHA512
2ecffdcb152f302ea16bbfdd57182ccac40361a2c2345cf41d0863685807ebdeaf9f8c43ce43816289d45352dbafade5c8ba820795c0c8c7cf8e016bcf8ade9d
-
SSDEEP
3072:l1NjcVVnLpPunb5AWOGVQurbu9wVL16oqjoKDqsuoSS4wNPiZeEHO3My6H+sUPln:HNeZm5A9GSgVL1jq7U7wpjtp6Hfq//Fp
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4428 eblupydfzx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3756 4428 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eblupydfzx.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3804 wrote to memory of 4428 3804 vbc1.exe 82 PID 3804 wrote to memory of 4428 3804 vbc1.exe 82 PID 3804 wrote to memory of 4428 3804 vbc1.exe 82 PID 4428 wrote to memory of 976 4428 eblupydfzx.exe 83 PID 4428 wrote to memory of 976 4428 eblupydfzx.exe 83 PID 4428 wrote to memory of 976 4428 eblupydfzx.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\malware\vbc1.exe"C:\Users\Admin\AppData\Local\Temp\malware\vbc1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\eblupydfzx.exeC:\Users\Admin\AppData\Local\Temp\eblupydfzx.exe C:\Users\Admin\AppData\Local\Temp\xxxknyg2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\eblupydfzx.exeC:\Users\Admin\AppData\Local\Temp\eblupydfzx.exe C:\Users\Admin\AppData\Local\Temp\xxxknyg3⤵PID:976
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 5483⤵
- Program crash
PID:3756
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4428 -ip 44281⤵PID:1664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5ca2bb1242c27b83ee0002fe931c4d5e0
SHA1a2da8943712e92171229fa0316398150594d2b40
SHA256189623f765bde100bf74824aca0038ecd2fea8ec2994c5e097ac657bfa1c5daf
SHA51273b166c1ff8d2c5b0c8ed28861b250e2e1689a6def66f990927d78d9053a1d9d51ca96959f75f9e43d2c1d9434d26931da967964f602d9e141ac816e5e3ffaa8
-
Filesize
213KB
MD54609cb6c51c7b7c4f657405eb57b8aad
SHA1728f3b05895500204b2e5223d387b024698f47b9
SHA256f22c27aa4edff08b75f27454d54397e1717ad6887d90f88f08b2c4531e788de1
SHA512c3ddcefb50ecbe338c4857b729dad07bb3de254371761dd545a39fa01292436d414cb9580bc53097200daca9f8fc455c815f192f3c5a959a8bd551c715d1cee3
-
Filesize
5KB
MD5f0724512513ceb7ffcc923b248aed4b9
SHA156b2d4b696e03f23c20eb8a9054fe9a1f775c58e
SHA256dec4eb54843f425648c34f5293557014234598dc56cfa4defce428a79066cf20
SHA5122a4d91f46062dfd069bdbe1a52d4d08d272fec28d1ed6de66725d06e16b93b7dfb91922e542db2567e2c0f7c91a2610bab90c370ac520929393746151f338a78