Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 05:50
Static task
static1
Behavioral task
behavioral1
Sample
34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe
Resource
win7-20240903-en
General
-
Target
34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe
-
Size
622KB
-
MD5
d9f52894276d2ace9df7005e70b36d00
-
SHA1
e3e53553774964d9cd864f827d279e962074b001
-
SHA256
34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7
-
SHA512
83982c4fa60c1a535297384ad2df98615b049d042f50bc1989006e84cc59f1de9c0929db3f0b4d0048f9aa4fea6ea7b0e610e40065aa50e9c38be042a307efca
-
SSDEEP
12288:fIlsAkjIf/WbGH/+8zoXEyO4M11fTcgoLLoa5RZMRGM4h/qofv:fHAL7+8zuErIgoLLoIZMRGJ/qofv
Malware Config
Signatures
-
Floxif family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023b8c-1.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c000000023b8c-1.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe -
pid Process 3836 arp.exe 2184 arp.exe 2552 arp.exe 4856 arp.exe 3052 arp.exe 4848 arp.exe 1516 arp.exe 4700 arp.exe 540 arp.exe -
resource yara_rule behavioral2/memory/1140-4-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/files/0x000c000000023b8c-1.dat upx behavioral2/memory/1140-9-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/1140-11-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/1140-15-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe File created \??\c:\program files\common files\system\symsrv.dll.000 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1516 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 83 PID 1140 wrote to memory of 1516 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 83 PID 1140 wrote to memory of 1516 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 83 PID 1140 wrote to memory of 3836 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 85 PID 1140 wrote to memory of 3836 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 85 PID 1140 wrote to memory of 3836 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 85 PID 1140 wrote to memory of 4848 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 86 PID 1140 wrote to memory of 4848 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 86 PID 1140 wrote to memory of 4848 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 86 PID 1140 wrote to memory of 3052 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 87 PID 1140 wrote to memory of 3052 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 87 PID 1140 wrote to memory of 3052 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 87 PID 1140 wrote to memory of 4856 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 88 PID 1140 wrote to memory of 4856 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 88 PID 1140 wrote to memory of 4856 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 88 PID 1140 wrote to memory of 540 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 89 PID 1140 wrote to memory of 540 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 89 PID 1140 wrote to memory of 540 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 89 PID 1140 wrote to memory of 2552 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 90 PID 1140 wrote to memory of 2552 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 90 PID 1140 wrote to memory of 2552 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 90 PID 1140 wrote to memory of 4700 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 91 PID 1140 wrote to memory of 4700 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 91 PID 1140 wrote to memory of 4700 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 91 PID 1140 wrote to memory of 2184 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 92 PID 1140 wrote to memory of 2184 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 92 PID 1140 wrote to memory of 2184 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 92 PID 1140 wrote to memory of 1016 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 104 PID 1140 wrote to memory of 1016 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 104 PID 1140 wrote to memory of 1016 1140 34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe"C:\Users\Admin\AppData\Local\Temp\34ab4b716bdd66690db71ccb7441f516eaa278d62ee924a0c82d3c1c00bc0ed7N.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\arp.exearp -a2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1516
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 a4-b3-10-8b-62-1c2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3836
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 5a-42-44-f2-6a-fa2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4848
-
-
C:\Windows\SysWOW64\arp.exearp -s 37.27.61.184 2f-a5-ad-39-80-0a2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3052
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 ad-e5-ff-78-83-f02⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4856
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 69-0e-5a-7a-02-172⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:540
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 43-eb-8f-2d-f3-a62⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 1c-4f-db-88-39-232⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4700
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 17-79-9f-d2-b5-ef2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2184
-
-
C:\Windows\SysWOW64\arp.exearp -d2⤵
- System Location Discovery: System Language Discovery
PID:1016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD54fcd7574537cebec8e75b4e646996643
SHA1efa59bb9050fb656b90d5d40c942fb2a304f2a8b
SHA2568ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d
SHA5127f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e