Overview
overview
10Static
static
10SugarLogic...AWS.sh
ubuntu-18.04-amd64
6SugarLogic...AWS.sh
debian-9-armhf
6SugarLogic...AWS.sh
debian-9-mips
6SugarLogic...AWS.sh
debian-9-mipsel
6SugarLogic...nge.sh
ubuntu-18.04-amd64
6SugarLogic...nge.sh
debian-9-armhf
6SugarLogic...nge.sh
debian-9-mips
6SugarLogic...nge.sh
debian-9-mipsel
6SugarLogic...tup.sh
windows7-x64
3SugarLogic...tup.sh
windows10-2004-x64
3SugarLogic...bot.sh
windows7-x64
3SugarLogic...bot.sh
windows10-2004-x64
3SugarLogic...d_2.sh
ubuntu-18.04-amd64
7SugarLogic...d_2.sh
debian-9-armhf
7SugarLogic...d_2.sh
debian-9-mips
7SugarLogic...d_2.sh
debian-9-mipsel
7SugarLogic...oit.sh
windows7-x64
3SugarLogic...oit.sh
windows10-2004-x64
3SugarLogic...arch64
ubuntu-18.04-amd64
SugarLogic...arch64
debian-9-armhf
SugarLogic...arch64
debian-9-mips
SugarLogic...arch64
debian-9-mipsel
SugarLogic...x86_64
ubuntu-22.04-amd64
10SugarLogic.../bot_u
ubuntu-22.04-amd64
10SugarLogic...en2.sh
ubuntu-18.04-amd64
3SugarLogic...en2.sh
debian-9-armhf
4SugarLogic...en2.sh
debian-9-mips
3SugarLogic...en2.sh
debian-9-mipsel
3SugarLogic...cap.so
ubuntu-22.04-amd64
1SugarLogic.../mo.sh
ubuntu-18.04-amd64
7SugarLogic.../mo.sh
debian-9-armhf
7SugarLogic.../mo.sh
debian-9-mips
10Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-12-2024 23:10
Behavioral task
behavioral1
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral5
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral6
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral7
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral8
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral9
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.XMR.tmp.Setup.sh
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.XMR.tmp.Setup.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.put.the.bot.sh
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.put.the.bot.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral14
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral15
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral16
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral17
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/MountSshExploit.sh
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/MountSshExploit.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral20
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral21
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral22
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral23
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/x86_64
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral24
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/bot_u
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral25
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral26
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral27
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral28
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral29
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/libpcap.so
Resource
ubuntu2204-amd64-20240729-en
Behavioral task
behavioral30
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral31
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral32
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
debian9-mipsbe-20240611-en
General
-
Target
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.XMR.tmp.Setup.sh
-
Size
245B
-
MD5
fd486a6a0c30fea7fdc578fb576dcd8b
-
SHA1
260b829fbf48e4b75e7273e80d575a5ca3c7a67b
-
SHA256
721d15556bd3c22f3b4c6240ff9c6d58bfa60b73b3793fa8cdc64b9e89521c5b
-
SHA512
96fe620e0f26a4b866bb762176f4245367e383b17166d7b809981ba0196671b8e3690ede60ed305a04a5e930b48fd2be63e5ad23a1cc4305fe6b7ebd80bacaf7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2788 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2788 AcroRd32.exe 2788 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2380 2244 cmd.exe 31 PID 2244 wrote to memory of 2380 2244 cmd.exe 31 PID 2244 wrote to memory of 2380 2244 cmd.exe 31 PID 2380 wrote to memory of 2788 2380 rundll32.exe 33 PID 2380 wrote to memory of 2788 2380 rundll32.exe 33 PID 2380 wrote to memory of 2788 2380 rundll32.exe 33 PID 2380 wrote to memory of 2788 2380 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SugarLogic_#teamtnt_by_@r3dbU7z\Kubernetes.XMR.tmp.Setup.sh1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SugarLogic_#teamtnt_by_@r3dbU7z\Kubernetes.XMR.tmp.Setup.sh2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SugarLogic_#teamtnt_by_@r3dbU7z\Kubernetes.XMR.tmp.Setup.sh"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2788
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD530ec526211606aa11af4a976134449bb
SHA129d5505c6398c25bccc895e1d18095806aa71559
SHA256438de303d7a326ae6b14b289f38e1bbcfa334baa792e9f893a62c7c89ec4212f
SHA51295f5aa30f2ce236e0cbe12714a391b598f3404c20c8288c5f9249415da58bc0187c626b561885a198f1a94f94d62a67f7b4ea463128b04c97fb850ec711c3b96