Overview
overview
10Static
static
10The-MALWAR...ot.exe
windows7-x64
10The-MALWAR...ot.exe
windows10-2004-x64
10The-MALWAR...ll.exe
windows7-x64
10The-MALWAR...ll.exe
windows10-2004-x64
10The-MALWAR...BS.exe
windows7-x64
10The-MALWAR...BS.exe
windows10-2004-x64
10The-MALWAR...in.exe
windows7-x64
7The-MALWAR...in.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
7The-MALWAR....A.exe
windows10-2004-x64
7The-MALWAR....A.exe
windows7-x64
10The-MALWAR....A.exe
windows10-2004-x64
10The-MALWAR...us.exe
windows7-x64
6The-MALWAR...us.exe
windows10-2004-x64
6The-MALWAR....a.exe
windows7-x64
3The-MALWAR....a.exe
windows10-2004-x64
3The-MALWAR....a.exe
windows7-x64
7The-MALWAR....a.exe
windows10-2004-x64
7The-MALWAR...ok.exe
windows7-x64
10The-MALWAR...ok.exe
windows10-2004-x64
1The-MALWAR...ft.exe
windows7-x64
4The-MALWAR...ft.exe
windows10-2004-x64
4The-MALWAR...en.exe
windows7-x64
6The-MALWAR...en.exe
windows10-2004-x64
6The-MALWAR...min.js
windows7-x64
3The-MALWAR...min.js
windows10-2004-x64
3The-MALWAR...ul.exe
windows7-x64
1The-MALWAR...ul.exe
windows10-2004-x64
3The-MALWAR....a.exe
windows7-x64
8The-MALWAR....a.exe
windows10-2004-x64
7The-MALWAR...99.exe
windows7-x64
5The-MALWAR...99.exe
windows10-2004-x64
5Analysis
-
max time kernel
140s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2025 14:56
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Banking-Malware/DanaBot.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Dridex.JhiSharp.dll.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexDroppedVBS.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Email-Worm/Amus.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Email-Worm/Amus.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Email-Worm/Anap.a.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Email-Worm/Anap.a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Email-Worm/Brontok.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Email-Worm/Brontok.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Email-Worm/Bugsoft.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Email-Worm/Bugsoft.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Email-Worm/Duksten.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Email-Worm/Duksten.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Email-Worm/Emin.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Email-Worm/Emin.js
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Email-Worm/Funsoul.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Email-Worm/Funsoul.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Email-Worm/Gruel.a.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Email-Worm/Gruel.a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Email-Worm/Happy99.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Email-Worm/Happy99.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
The-MALWARE-Repo-master/Email-Worm/Axam.a.exe
-
Size
11KB
-
MD5
0fbf8022619ba56c545b20d172bf3b87
-
SHA1
752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
-
SHA256
4ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
-
SHA512
e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb
-
SSDEEP
192:33K8Vn5fAIBkPA9tQdEnhAv+mKqh1RwE9gCOMv8eIry2aZoa5qq/:33X54IB8SCY2W3qmSgaIrTDSqq/
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Axam.exe Axam.a.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sysaxam32 = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe" Axam.a.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Edonkey2000\Incoming\setup_flash.exe Axam.a.exe File created C:\Program Files (x86)\limewire\Shared\Super Mario.exe Axam.a.exe File created C:\Program Files (x86)\KMD\My Shared Folder\Axam.exe Axam.a.exe File created C:\Program Files (x86)\Kazaa\My Shared Folder\Invisible_man.exe Axam.a.exe File created C:\Program Files (x86)\KaZaA Lite\My Shared Folder\AjeedNASA.exe Axam.a.exe File created C:\Program Files (x86)\Morpheus\My Shared Folder\Blaster.exe Axam.a.exe File created C:\Program Files (x86)\Grokster\My Grokster\XXX_HOTSEX.exe Axam.a.exe File created C:\Program Files (x86)\BearShare\Shared\fxbgbear.exe Axam.a.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Axam.a.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "Spitmaxa" Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Roaming\\Axam.exe \"%1\" %*" Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa Axam.a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\DefaultIcon\ = "%1" Axam.a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Spitmaxa\shell\open\command Axam.a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe 2628 Axam.a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2628 Axam.a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Axam.a.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Axam.a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD50fbf8022619ba56c545b20d172bf3b87
SHA1752e5ce51f0cf9192b8fa1d28a7663b46e3577ff
SHA2564ae7d63ec497143c2acde1ba79f1d9eed80086a420b6f0a07b1e2917da0a6c74
SHA512e8d44147609d04a1a158066d89b739c00b507c8ff208dac72fdc2a42702d336c057ae4b77c305f4ccdfe089665913098d84a3160a834aaebe41f95f4b4bfddeb