Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/03/2025, 00:03 UTC
Behavioral task
behavioral1
Sample
3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe
Resource
win7-20240903-en
General
-
Target
3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe
-
Size
803KB
-
MD5
d9088a749f3b68662c2773eb637b0b6b
-
SHA1
907d48cbda81f3e4d9cd724154605f0657935ef8
-
SHA256
3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea
-
SHA512
ac27136531285dc2292d1ca8604955c0460f4d481f33857e72ab77d09cb89d0929c1bd4a624cf39c94fe87353ca201af4f914edf74fe2fd1a72c22d2688e2e73
-
SSDEEP
24576:bkGvM/P1U4bBTOKr26GU5OYsnXgxvrQrAnuIw9:b2/P1UOtOKC6GrYsgxTQTIG
Malware Config
Signatures
-
Imminent family
-
Executes dropped EXE 2 IoCs
pid Process 328 refsutil.exe 1700 refsutil.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1840-14-0x00000000010B0000-0x0000000001238000-memory.dmp autoit_exe behavioral1/memory/328-35-0x0000000001320000-0x00000000014A8000-memory.dmp autoit_exe behavioral1/memory/1700-50-0x0000000000060000-0x00000000001E8000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1840 set thread context of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 328 set thread context of 792 328 refsutil.exe 40 PID 1700 set thread context of 3064 1700 refsutil.exe 44 -
resource yara_rule behavioral1/memory/1840-0-0x00000000010B0000-0x0000000001238000-memory.dmp upx behavioral1/memory/1840-14-0x00000000010B0000-0x0000000001238000-memory.dmp upx behavioral1/files/0x000f000000018683-22.dat upx behavioral1/memory/328-24-0x0000000001320000-0x00000000014A8000-memory.dmp upx behavioral1/memory/328-35-0x0000000001320000-0x00000000014A8000-memory.dmp upx behavioral1/memory/1700-38-0x0000000000060000-0x00000000001E8000-memory.dmp upx behavioral1/memory/1700-50-0x0000000000060000-0x00000000001E8000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language refsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language refsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2936 schtasks.exe 1096 schtasks.exe 2328 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1564 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1564 RegAsm.exe Token: 33 1564 RegAsm.exe Token: SeIncBasePriorityPrivilege 1564 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1564 RegAsm.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 1840 wrote to memory of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 1840 wrote to memory of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 1840 wrote to memory of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 1840 wrote to memory of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 1840 wrote to memory of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 1840 wrote to memory of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 1840 wrote to memory of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 1840 wrote to memory of 1564 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 31 PID 1840 wrote to memory of 2936 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 32 PID 1840 wrote to memory of 2936 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 32 PID 1840 wrote to memory of 2936 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 32 PID 1840 wrote to memory of 2936 1840 3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe 32 PID 2980 wrote to memory of 328 2980 taskeng.exe 39 PID 2980 wrote to memory of 328 2980 taskeng.exe 39 PID 2980 wrote to memory of 328 2980 taskeng.exe 39 PID 2980 wrote to memory of 328 2980 taskeng.exe 39 PID 328 wrote to memory of 792 328 refsutil.exe 40 PID 328 wrote to memory of 792 328 refsutil.exe 40 PID 328 wrote to memory of 792 328 refsutil.exe 40 PID 328 wrote to memory of 792 328 refsutil.exe 40 PID 328 wrote to memory of 792 328 refsutil.exe 40 PID 328 wrote to memory of 792 328 refsutil.exe 40 PID 328 wrote to memory of 792 328 refsutil.exe 40 PID 328 wrote to memory of 792 328 refsutil.exe 40 PID 328 wrote to memory of 792 328 refsutil.exe 40 PID 328 wrote to memory of 1096 328 refsutil.exe 41 PID 328 wrote to memory of 1096 328 refsutil.exe 41 PID 328 wrote to memory of 1096 328 refsutil.exe 41 PID 328 wrote to memory of 1096 328 refsutil.exe 41 PID 2980 wrote to memory of 1700 2980 taskeng.exe 43 PID 2980 wrote to memory of 1700 2980 taskeng.exe 43 PID 2980 wrote to memory of 1700 2980 taskeng.exe 43 PID 2980 wrote to memory of 1700 2980 taskeng.exe 43 PID 1700 wrote to memory of 3064 1700 refsutil.exe 44 PID 1700 wrote to memory of 3064 1700 refsutil.exe 44 PID 1700 wrote to memory of 3064 1700 refsutil.exe 44 PID 1700 wrote to memory of 3064 1700 refsutil.exe 44 PID 1700 wrote to memory of 3064 1700 refsutil.exe 44 PID 1700 wrote to memory of 3064 1700 refsutil.exe 44 PID 1700 wrote to memory of 3064 1700 refsutil.exe 44 PID 1700 wrote to memory of 3064 1700 refsutil.exe 44 PID 1700 wrote to memory of 3064 1700 refsutil.exe 44 PID 1700 wrote to memory of 2328 1700 refsutil.exe 45 PID 1700 wrote to memory of 2328 1700 refsutil.exe 45 PID 1700 wrote to memory of 2328 1700 refsutil.exe 45 PID 1700 wrote to memory of 2328 1700 refsutil.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe"C:\Users\Admin\AppData\Local\Temp\3f128a6477d3d836accf898a564082a9ba4b50168bd16eac89c16ea09edd85ea.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1564
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn NgcIso /tr "C:\Users\Admin\advpack\refsutil.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2936
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1232
-
C:\Windows\system32\taskeng.exetaskeng.exe {12563DD0-A3C7-4E60-9797-A7D181D927E6} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\advpack\refsutil.exeC:\Users\Admin\advpack\refsutil.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
PID:792
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn NgcIso /tr "C:\Users\Admin\advpack\refsutil.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1096
-
-
-
C:\Users\Admin\advpack\refsutil.exeC:\Users\Admin\advpack\refsutil.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3064
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn NgcIso /tr "C:\Users\Admin\advpack\refsutil.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2328
-
-
Network
- No results found
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
104 B 2
-
96 B 2
-
52 B 1
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
803KB
MD523d6c2932761c53ee3aa216a2717fcd4
SHA1158bff81c905c0de242746bd78200049ad9b3a5e
SHA2568dde4430b58fa190cf43c0e236d1441dbbfb242ae3bd8209bfe6bec1a4285f36
SHA512f1368a21668ff7e439fc43b7eca5b9363bb4d83d24f71b1f43770c79e4dbf5a3e7248ae421b45098c2205aa12da12fe4f51572f8c0e9004d7c0dd16b1f301ac5