Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 02:40
Static task
static1
Behavioral task
behavioral1
Sample
4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
General
-
Target
4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe
-
Size
1.0MB
-
MD5
68ad57514cfb4e1cb4529556dbbc9b73
-
SHA1
3681d090c965cd8af1c7bffd6fe5427e997daa41
-
SHA256
4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac
-
SHA512
f2ef34f8ad5282676bdc3913007d471cc59e1bf20c5371817b3c85a2c24c19983d3c6c2f5e00bb539fc6596a0b02b4a33e59a4391a4165c22e0cbf2edd103f5a
-
SSDEEP
24576:ENrNYo6GP6fzfqUC1tkth3VwV5k7j5awX300zQUGtZq:U+S6fziUC1wh3VwXgj5aEkHUGtZq
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2404 powershell.exe -
Loads dropped DLL 1 IoCs
pid Process 1928 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\stilhederne\tamtammens.ini 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\inddatafunktionens.Tra 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2404 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2404 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2404 1928 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe 30 PID 1928 wrote to memory of 2404 1928 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe 30 PID 1928 wrote to memory of 2404 1928 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe 30 PID 1928 wrote to memory of 2404 1928 4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe"C:\Users\Admin\AppData\Local\Temp\4b0c3d89a63dc1f177379ea05642c3c3b377adc560b26c7a41aebd2ed1afe9ac.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Veges95=gc -raw 'C:\Users\Admin\AppData\Local\Temp\globosely\baadehavn\stnner\takelma.Uns';$Makulaturs=$Veges95.SubString(71268,3);.$Makulaturs($Veges95) "2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5675c4948e1efc929edcabfe67148eddd
SHA1f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA2561076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
SHA51261737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683