Overview
overview
10Static
static
3Versium Re...fa.exe
windows7-x64
10Versium Re...fa.exe
windows10-2004-x64
10Versium Re...er.exe
windows7-x64
3Versium Re...er.exe
windows10-2004-x64
7Versium Re...ll.exe
windows7-x64
7Versium Re...ll.exe
windows10-2004-x64
7Versium Re...um.exe
windows7-x64
7Versium Re...um.exe
windows10-2004-x64
7Versium Re...it.exe
windows7-x64
10Versium Re...it.exe
windows10-2004-x64
10Versium Re...it.exe
windows7-x64
1Versium Re...it.exe
windows10-2004-x64
1Versium Re...ch.exe
windows7-x64
6Versium Re...ch.exe
windows10-2004-x64
6Analysis
-
max time kernel
15s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 20:12
Static task
static1
Behavioral task
behavioral1
Sample
Versium Research/028d53f5224f9cc8c60bd953504f1efa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Versium Research/028d53f5224f9cc8c60bd953504f1efa.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Versium Research/Bot_Checker.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Versium Research/Bot_Checker.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Versium Research/Uninstall.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Versium Research/Uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Versium Research/Versium.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
Versium Research/Versium.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Versium Research/VersiumResearch32bit.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Versium Research/VersiumResearch32bit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Versium Research/VersiumResearch64bit.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Versium Research/VersiumResearch64bit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Versium Research/Versiumresearch.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Versium Research/Versiumresearch.exe
Resource
win10v2004-20241007-en
General
-
Target
Versium Research/Uninstall.exe
-
Size
97KB
-
MD5
a8c53399726fea24e4af993e971df5af
-
SHA1
50b4c4d3cf172106417dc0e59eaa63bf7cd0603e
-
SHA256
6b13a733947bc2395695cc6f9a8b59eae88cf6467e368a810bcac0c10d6c46a6
-
SHA512
b2159712ecfa8f7e9a75a190e858cc791bcdcd19118a6db40041d7ffbda531343a63244d35012702dda8514191e8bf6e838ab896c9db232f2c163fc4d4cd2bf9
-
SSDEEP
1536:zO/z6hPABUjO/Zd1716EoLiL4l1HdIaqQPDm0xK8i6f0Zn9PRVW8sW45o75U:kzgjO/Zd1RePDmZ8tf05iW4u1U
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2288 Uninstall.exe -
Loads dropped DLL 1 IoCs
pid Process 1276 Uninstall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstall.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2288 1276 Uninstall.exe 29 PID 1276 wrote to memory of 2288 1276 Uninstall.exe 29 PID 1276 wrote to memory of 2288 1276 Uninstall.exe 29 PID 1276 wrote to memory of 2288 1276 Uninstall.exe 29 PID 1276 wrote to memory of 2288 1276 Uninstall.exe 29 PID 1276 wrote to memory of 2288 1276 Uninstall.exe 29 PID 1276 wrote to memory of 2288 1276 Uninstall.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Versium Research\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\Versium Research\Uninstall.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe" end2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5a8c53399726fea24e4af993e971df5af
SHA150b4c4d3cf172106417dc0e59eaa63bf7cd0603e
SHA2566b13a733947bc2395695cc6f9a8b59eae88cf6467e368a810bcac0c10d6c46a6
SHA512b2159712ecfa8f7e9a75a190e858cc791bcdcd19118a6db40041d7ffbda531343a63244d35012702dda8514191e8bf6e838ab896c9db232f2c163fc4d4cd2bf9