Overview
overview
10Static
static
10The-MALWAR...ot.exe
windows10-ltsc 2021-x64
10The-MALWAR...ll.exe
windows10-ltsc 2021-x64
10The-MALWAR...BS.exe
windows10-ltsc 2021-x64
10The-MALWAR...in.exe
windows10-ltsc 2021-x64
7The-MALWAR....A.exe
windows10-ltsc 2021-x64
7The-MALWAR....A.exe
windows10-ltsc 2021-x64
10The-MALWAR...us.exe
windows10-ltsc 2021-x64
6The-MALWAR....a.exe
windows10-ltsc 2021-x64
3The-MALWAR....a.exe
windows10-ltsc 2021-x64
7The-MALWAR...ok.exe
windows10-ltsc 2021-x64
1The-MALWAR...ft.exe
windows10-ltsc 2021-x64
4The-MALWAR...en.exe
windows10-ltsc 2021-x64
6The-MALWAR...ul.exe
windows10-ltsc 2021-x64
3The-MALWAR....a.exe
windows10-ltsc 2021-x64
7The-MALWAR...99.exe
windows10-ltsc 2021-x64
5The-MALWAR...ay.exe
windows10-ltsc 2021-x64
7The-MALWAR....e.exe
windows10-ltsc 2021-x64
7The-MALWAR...on.exe
windows10-ltsc 2021-x64
7The-MALWAR....d.exe
windows10-ltsc 2021-x64
7The-MALWAR...tr.exe
windows10-ltsc 2021-x64
3The-MALWAR....a.exe
windows10-ltsc 2021-x64
5The-MALWAR...ri.exe
windows10-ltsc 2021-x64
3The-MALWAR...en.exe
windows10-ltsc 2021-x64
3The-MALWAR...ur.exe
windows10-ltsc 2021-x64
5The-MALWAR...ld.exe
windows10-ltsc 2021-x64
3The-MALWAR....A.exe
windows10-ltsc 2021-x64
10The-MALWAR....a.exe
windows10-ltsc 2021-x64
3The-MALWAR...fe.exe
windows10-ltsc 2021-x64
3The-MALWAR....E.exe
windows10-ltsc 2021-x64
5The-MALWAR...hu.exe
windows10-ltsc 2021-x64
3The-MALWAR...in.exe
windows10-ltsc 2021-x64
4The-MALWAR...mo.exe
windows10-ltsc 2021-x64
6Analysis
- max time kernel
148s - max time network
163s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20241023-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system - submitted
04/01/2025, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Email-Worm/Amus.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Email-Worm/Anap.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Email-Worm/Brontok.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Email-Worm/Bugsoft.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Email-Worm/Duksten.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Email-Worm/Funsoul.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Email-Worm/Gruel.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Email-Worm/Happy99.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Email-Worm/Kiray.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Email-Worm/Klez.e.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Email-Worm/Lacon.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Email-Worm/Lentin/Lentin.d.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Email-Worm/Magistr.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Email-Worm/Maldal.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Email-Worm/Mari.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Email-Worm/MeltingScreen.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Email-Worm/Merkur.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Email-Worm/MsWorld.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Email-Worm/MyDoom.A.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Email-Worm/MyPics.a.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Email-Worm/NakedWife.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Email-Worm/Nyxem.E.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Email-Worm/Pikachu.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Email-Worm/Prolin.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Email-Worm/Quamo.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
General
- Target The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
- Size 11KB
- Sample250104-bfacxavpgr
- SHA256 4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
- MD5 0fbf8022619ba56c545b20d172bf3b87
- SHA1 752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
- SHA512 e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb
- SSDEEP 192:33K8Vn5fAIBkPA9tQdEnhAv+mKqh1RwE9gCOMv8eIry2aZoa5qq/:33X54IB8SCY2W3qmSgaIrTDSqq/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.a.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysaxam32 = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe" Axam.a.exe - Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Edonkey2000\Incoming\setup_flash.exe Axam.a.exe File created C:\Program Files (x86)\limewire\Shared\Super Mario.exe Axam.a.exe File created C:\Program Files (x86)\KMD\My Shared Folder\Axam.exe Axam.a.exe File created C:\Program Files (x86)\Kazaa\My Shared Folder\Invisible_man.exe Axam.a.exe File created C:\Program Files (x86)\KaZaA Lite\My Shared Folder\AjeedNASA.exe Axam.a.exe File created C:\Program Files (x86)\Morpheus\My Shared Folder\Blaster.exe Axam.a.exe File created C:\Program Files (x86)\Grokster\My Grokster\XXX_HOTSEX.exe Axam.a.exe File created C:\Program Files (x86)\BearShare\Shared\fxbgbear.exe Axam.a.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Axam.a.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe \"%1\" %*" Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "Spitmaxa" Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon\ = "%1" Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell Axam.a.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe 3588 Axam.a.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3588 Axam.a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Axam.a.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Axam.a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Axam.exe
- Size 11KB
- SHA256 4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
- MD5 0fbf8022619ba56c545b20d172bf3b87
- SHA1 752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
- SHA512 e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb
- SSDEEP 192:33K8Vn5fAIBkPA9tQdEnhAv+mKqh1RwE9gCOMv8eIry2aZoa5qq/:33X54IB8SCY2W3qmSgaIrTDSqq/
- MD5 SHA1 SHA512 SSDEEP