9bd03d5adeab12d68f22e7f8967b8b49c8b17c933eead9bda7929ca71a3ec051

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2024, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TT copt mt103.pdf.exe
Size 1.2MB
Sample241230-q4nyjayqfv
SHA256 9bd03d5adeab12d68f22e7f8967b8b49c8b17c933eead9bda7929ca71a3ec051
MD5 c10d464c3c3cffc66e7d9473d6c0489e
SHA1 68a86d6c0144c3e77b4b4d921f6a9aea0f8ba5cd
SHA512 e768fe0de7803e83c2f8a957cd1cfdc560518db40a3e8ce82a16add65e0417de16812dc8468f1f1c0f9e20e1fd8578c228ef60fd0cef5539a3b030324bfb1249
SSDEEP 24576:BqDEvCTbMWu7rQYlBQcBiT6rprG8aj3C3WfVAcpIk9ei:BTvC/MTQYxsWR7aj31PIi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\atule.vbs	atule.exe

Executes dropped EXE 1 IoCs

pid	Process
5044	atule.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023cc1-11.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5044 set thread context of 4620	5044	atule.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4672	4620	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TT copt mt103.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	atule.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5044	atule.exe
5044	atule.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 5044	1192	TT copt mt103.pdf.exe	85
PID 1192 wrote to memory of 5044	1192	TT copt mt103.pdf.exe	85
PID 1192 wrote to memory of 5044	1192	TT copt mt103.pdf.exe	85
PID 5044 wrote to memory of 4620	5044	atule.exe	87
PID 5044 wrote to memory of 4620	5044	atule.exe	87
PID 5044 wrote to memory of 4620	5044	atule.exe	87
PID 5044 wrote to memory of 4620	5044	atule.exe	87

C:\Users\Admin\AppData\Local\Temp\TT copt mt103.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\TT copt mt103.pdf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Vevina\atule.exe
  "C:\Users\Admin\AppData\Local\Temp\TT copt mt103.pdf.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\TT copt mt103.pdf.exe"
    3⤵
    PID:4620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 192
      4⤵
      Program crash
      PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4620 -ip 4620
1⤵
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autABB1.tmp

Path C:\Users\Admin\AppData\Local\Temp\autABB1.tmp
Size 282KB
SHA256 3855b37abd131ef08529c030bc148cf8bef9860271b88690f284fab9a9d836aa
MD5 862855c2cfe31ca280a5f1c312347193
SHA1 d1282823ec5058bede6802513f3fb2751693e3ee
SHA512 59f33ca36b6596d742007acd517d719e2a9ef0ef9302fae0ec913b4380f409e942ddee9bd546d4136a03b158b3cd00c1417175bdef6dd6f14ffc2d5403b2a33a
SSDEEP 6144:2vAAwr+1IUJxw2mCkSAhieOIjotmKdnB4JidbbxvQUk2VBJqFINwTFF2dsmK:iAAQ+1DJxw2m1hdjotmKZBJbxv/zVWIA
MD5 SHA1 SHA512 SSDEEP

Submit Download

atule.exe

Path C:\Users\Admin\AppData\Local\Vevina\atule.exe
Size 1.2MB
SHA256 9bd03d5adeab12d68f22e7f8967b8b49c8b17c933eead9bda7929ca71a3ec051
MD5 c10d464c3c3cffc66e7d9473d6c0489e
SHA1 68a86d6c0144c3e77b4b4d921f6a9aea0f8ba5cd
SHA512 e768fe0de7803e83c2f8a957cd1cfdc560518db40a3e8ce82a16add65e0417de16812dc8468f1f1c0f9e20e1fd8578c228ef60fd0cef5539a3b030324bfb1249
SSDEEP 24576:BqDEvCTbMWu7rQYlBQcBiT6rprG8aj3C3WfVAcpIk9ei:BTvC/MTQYxsWR7aj31PIi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1192-8-0x00000000018C0000-0x0000000001CC0000-memory.dmp

Download

memory/4620-24-0x0000000000690000-0x00000000006D7000-memory.dmp

Download

memory/5044-22-0x0000000001470000-0x0000000001870000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads