Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 08:21
Static task
static1
Behavioral task
behavioral1
Sample
da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe
-
Size
88KB
-
MD5
eb9ce45bdaab26380a0ad8e4cbb64d70
-
SHA1
43d4272f612d9ed6f75e451e820bf5c8797a3875
-
SHA256
da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6ab
-
SHA512
70ae04cc56ca3c1b634f1bff9cca11a4bfab9d6e2ecff49798ab80616e3a1f596e5b249dfb548217d680dae6425309dc6aa2d4433eb54b99fd804046183aa10f
-
SSDEEP
768:6lXIB+dyAnffZzCjsK2+/T/PmLRBNV3ZJfqHJvE/AZbyd:6JIQAER5K2KjPmLRBNJqHJNZmd
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
tougu.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tougu.exe -
Executes dropped EXE 1 IoCs
Processes:
tougu.exepid Process 2164 tougu.exe -
Loads dropped DLL 2 IoCs
Processes:
da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exepid Process 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tougu.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\tougu = "C:\\Users\\Admin\\tougu.exe" tougu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2688 3068 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exetougu.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tougu.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tougu.exepid Process 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe 2164 tougu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exetougu.exepid Process 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 2164 tougu.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exetougu.exedescription pid Process procid_target PID 3068 wrote to memory of 2164 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 30 PID 3068 wrote to memory of 2164 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 30 PID 3068 wrote to memory of 2164 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 30 PID 3068 wrote to memory of 2164 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 30 PID 3068 wrote to memory of 2688 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 31 PID 3068 wrote to memory of 2688 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 31 PID 3068 wrote to memory of 2688 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 31 PID 3068 wrote to memory of 2688 3068 da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe 31 PID 2164 wrote to memory of 3068 2164 tougu.exe 29 PID 2164 wrote to memory of 3068 2164 tougu.exe 29 PID 2164 wrote to memory of 2688 2164 tougu.exe 31 PID 2164 wrote to memory of 2688 2164 tougu.exe 31 PID 2164 wrote to memory of 3068 2164 tougu.exe 29 PID 2164 wrote to memory of 3068 2164 tougu.exe 29 PID 2164 wrote to memory of 2688 2164 tougu.exe 31 PID 2164 wrote to memory of 2688 2164 tougu.exe 31 PID 2164 wrote to memory of 3068 2164 tougu.exe 29 PID 2164 wrote to memory of 3068 2164 tougu.exe 29 PID 2164 wrote to memory of 2688 2164 tougu.exe 31 PID 2164 wrote to memory of 2688 2164 tougu.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe"C:\Users\Admin\AppData\Local\Temp\da0e69d3282335937e7e3f882d324760130b1ef636eb302e28a234de81e2f6abN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\tougu.exe"C:\Users\Admin\tougu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 7882⤵
- Program crash
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD52929ea3f1a8e3e6856ea39f71f03470a
SHA1ab65f2b67aebaf1cd512c307dd6d5488ea83fc66
SHA256d9fce2bc78be2a23ed7c68818e1ce2231d7c78cda050d2deb13577bb7d8fa1d4
SHA5120715bd764cc9387b127e83e01812ca8b5ac53506ee2ae749385e7b847e44fbe71408a8b9b17dea3f33eb199ee6e5bbf1c36e6425eb8b2c98a6d913c91e8c6e31