Overview
overview
10Static
static
10foo/0044d6...f7.exe
windows7-x64
1foo/0044d6...f7.exe
windows10-2004-x64
3foo/034e4c...a9.exe
windows7-x64
4foo/034e4c...a9.exe
windows10-2004-x64
4foo/035fa2...72.exe
windows7-x64
6foo/035fa2...72.exe
windows10-2004-x64
6foo/04884a...1b.exe
windows7-x64
7foo/04884a...1b.exe
windows10-2004-x64
7foo/06ed82...59.exe
windows7-x64
7foo/06ed82...59.exe
windows10-2004-x64
7foo/07470b...68.exe
windows7-x64
7foo/07470b...68.exe
windows10-2004-x64
7foo/078adb...c0.exe
windows7-x64
10foo/078adb...c0.exe
windows10-2004-x64
10foo/09e5c8...b4.exe
windows7-x64
3foo/09e5c8...b4.exe
windows10-2004-x64
3foo/0becfe...f4.exe
windows7-x64
10foo/0becfe...f4.exe
windows10-2004-x64
10foo/1a78d3...a3.exe
windows7-x64
5foo/1a78d3...a3.exe
windows10-2004-x64
7foo/1ffe82...a6.exe
windows7-x64
10foo/1ffe82...a6.exe
windows10-2004-x64
10foo/255028...e1.dll
windows7-x64
3foo/255028...e1.dll
windows10-2004-x64
3foo/27601d...cc.exe
windows7-x64
7foo/27601d...cc.exe
windows10-2004-x64
7foo/27f911...49.exe
windows7-x64
10foo/27f911...49.exe
windows10-2004-x64
10foo/28408c...c5.exe
windows7-x64
10foo/28408c...c5.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
142s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 17:46
Static task
static1
Behavioral task
behavioral1
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
-
Size
291KB
-
MD5
035fa2f2fae0a8fad733686a7d9ea772
-
SHA1
411ee99b26bb612b1905b0c7254129fb1dd0cb56
-
SHA256
f823ee1362132d0c4cb632829abbaae16b7ae8f938e86a10bdab3897e4f5dc8c
-
SHA512
9a58f3b940e83e79fd7c7353b8d20947ab45ee48c617217f7c5ac58b1a0d0b5904eda1d49eb118a55f309291055b50b4710a6ab598ae5b29bbb6ff541ab599f1
-
SSDEEP
6144:hU/fPSy2JA1hNbd+DBkY4vfZq05OW9ZA8rkjos1qLej:hk3Sy2JIhNbdEkxvfZNT9ZA8rEos1Rj
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 035fa2f2fae0a8fad733686a7d9ea772.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 035fa2f2fae0a8fad733686a7d9ea772.exe -
resource yara_rule behavioral6/memory/3952-0-0x0000000000400000-0x00000000004BE000-memory.dmp upx behavioral6/memory/3952-1-0x0000000000400000-0x00000000004BE000-memory.dmp upx behavioral6/memory/3952-5-0x0000000000400000-0x00000000004BE000-memory.dmp upx behavioral6/memory/3952-7-0x0000000000400000-0x00000000004BE000-memory.dmp upx behavioral6/memory/3952-8-0x0000000000400000-0x00000000004BE000-memory.dmp upx behavioral6/memory/3952-9-0x0000000000400000-0x00000000004BE000-memory.dmp upx behavioral6/memory/3952-10-0x0000000000400000-0x00000000004BE000-memory.dmp upx behavioral6/memory/3952-25-0x0000000000400000-0x00000000004BE000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 035fa2f2fae0a8fad733686a7d9ea772.exe -
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 035fa2f2fae0a8fad733686a7d9ea772.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 035fa2f2fae0a8fad733686a7d9ea772.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3952 035fa2f2fae0a8fad733686a7d9ea772.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\foo\035fa2f2fae0a8fad733686a7d9ea772.exe"C:\Users\Admin\AppData\Local\Temp\foo\035fa2f2fae0a8fad733686a7d9ea772.exe"1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:3952