Overview
overview
10Static
static
102a58deb886...91.exe
windows7-x64
72a58deb886...91.exe
windows10-2004-x64
72a8a0bca04...56.exe
windows7-x64
12a8a0bca04...56.exe
windows10-2004-x64
12a9ffe006a...34.exe
windows7-x64
102a9ffe006a...34.exe
windows10-2004-x64
102ab11ad915...2a.exe
windows7-x64
82ab11ad915...2a.exe
windows10-2004-x64
82ac1621a2b...d2.exe
windows7-x64
72ac1621a2b...d2.exe
windows10-2004-x64
72b3308a415...7b.exe
windows7-x64
72b3308a415...7b.exe
windows10-2004-x64
72b3fba9224...50.exe
windows7-x64
102b3fba9224...50.exe
windows10-2004-x64
102b820e3de5...95.exe
windows7-x64
72b820e3de5...95.exe
windows10-2004-x64
72b9233e0b0...ed.exe
windows7-x64
72b9233e0b0...ed.exe
windows10-2004-x64
72bb7c2979e...c6.exe
windows7-x64
102bb7c2979e...c6.exe
windows10-2004-x64
82bcc16cd37...1b.exe
windows7-x64
72bcc16cd37...1b.exe
windows10-2004-x64
72bf6115ff0...e6.exe
windows7-x64
102bf6115ff0...e6.exe
windows10-2004-x64
102bfb9d98d1...aa.exe
windows7-x64
32bfb9d98d1...aa.exe
windows10-2004-x64
32c1bb67a63...62.exe
windows7-x64
102c1bb67a63...62.exe
windows10-2004-x64
102c878e31ca...a9.exe
windows7-x64
92c878e31ca...a9.exe
windows10-2004-x64
92ccb525855...c9.exe
windows7-x64
12ccb525855...c9.exe
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:09
Behavioral task
behavioral1
Sample
2a58deb8862cf7fc15015cfdc2e12d91.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral2
Sample
2a58deb8862cf7fc15015cfdc2e12d91.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
2a8a0bca043dc99715ebb4415693e52371edde1f37fb8451d9175328fefa7456.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
2a8a0bca043dc99715ebb4415693e52371edde1f37fb8451d9175328fefa7456.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
2a9ffe006a29261c5f168fdf0fe26434.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
2a9ffe006a29261c5f168fdf0fe26434.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2ab11ad915b74ff1dd9a0ab743f7bb2a.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
2ab11ad915b74ff1dd9a0ab743f7bb2a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
2ac1621a2b0813529021feefa223b3124176ec82974f0bc9b4b1365328e3d7d2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
2ac1621a2b0813529021feefa223b3124176ec82974f0bc9b4b1365328e3d7d2.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2b3308a4153ff3a99a4355a4b70e96779a5f60a820b4b65dcf1ffb6b6d5b4b7b.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
2b3308a4153ff3a99a4355a4b70e96779a5f60a820b4b65dcf1ffb6b6d5b4b7b.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
2b3fba9224cbcf82f7414bdb4108a150.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
2b3fba9224cbcf82f7414bdb4108a150.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
2b820e3de58782883087f0783d484f95.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral16
Sample
2b820e3de58782883087f0783d484f95.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
2b9233e0b054ff4f7ea7d7a0a77e3fed.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
2b9233e0b054ff4f7ea7d7a0a77e3fed.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
2bb7c2979e9372d006198745f13bf5c6.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
2bb7c2979e9372d006198745f13bf5c6.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
2bcc16cd37f40f56e357c814f3958491062e5be750c5c8dc9d077815d7f5461b.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
2bcc16cd37f40f56e357c814f3958491062e5be750c5c8dc9d077815d7f5461b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
2bf6115ff0a234d8ea278864c5abbbe6.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral24
Sample
2bf6115ff0a234d8ea278864c5abbbe6.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
2bfb9d98d1176802c3f20b3ed364ccaa.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
2bfb9d98d1176802c3f20b3ed364ccaa.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
2c1bb67a6359e933d609019759d98e62.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
2c1bb67a6359e933d609019759d98e62.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
2c878e31cad36b4acf60c3cbde88ebe56fdb1cd5d4bab9a60508b1023d3a33a9.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
2c878e31cad36b4acf60c3cbde88ebe56fdb1cd5d4bab9a60508b1023d3a33a9.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
2ccb525855c096117a4ce773ceb6afc9.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral32
Sample
2ccb525855c096117a4ce773ceb6afc9.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
2bb7c2979e9372d006198745f13bf5c6.exe
-
Size
37KB
-
MD5
2bb7c2979e9372d006198745f13bf5c6
-
SHA1
1c4b3f17b3d2640976d9126fdcc42344bb2b9cf3
-
SHA256
d5673188c792f3265504fbb7fd9f01a016443b24e3f16321b92c2f8cd2781e99
-
SHA512
c8e17bc5dca8d462f96a6bfea459f6e8c73a35978e55db2f3e34b14a221595c9ba9acf27c838b906b6ae6c66afc73967d28508da0e754ec10dfe4e26ba14b46b
-
SSDEEP
384:c0bKMizdhjnBhFbJ8ycPpbfbLwCwEfrAF+rMRTyN/0L+EcoinblneHQM3epzXTNp:bbghlLJfcPpb/FwyrM+rMRa8NuNVt
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4360 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation 2bb7c2979e9372d006198745f13bf5c6.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bfcd93b9dd810793ea187614b1cdc5e8.exe system.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bfcd93b9dd810793ea187614b1cdc5e8.exe system.exe -
Executes dropped EXE 1 IoCs
pid Process 1448 system.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bfcd93b9dd810793ea187614b1cdc5e8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\system.exe\" .." system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bfcd93b9dd810793ea187614b1cdc5e8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\system.exe\" .." system.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 26 2.tcp.ngrok.io 60 2.tcp.ngrok.io 81 2.tcp.ngrok.io -
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created D:\autorun.inf system.exe File created F:\autorun.inf system.exe File opened for modification F:\autorun.inf system.exe File created C:\autorun.inf system.exe File opened for modification C:\autorun.inf system.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2bb7c2979e9372d006198745f13bf5c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe 1448 system.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1448 system.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe Token: 33 1448 system.exe Token: SeIncBasePriorityPrivilege 1448 system.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4012 wrote to memory of 1448 4012 2bb7c2979e9372d006198745f13bf5c6.exe 87 PID 4012 wrote to memory of 1448 4012 2bb7c2979e9372d006198745f13bf5c6.exe 87 PID 4012 wrote to memory of 1448 4012 2bb7c2979e9372d006198745f13bf5c6.exe 87 PID 1448 wrote to memory of 4360 1448 system.exe 90 PID 1448 wrote to memory of 4360 1448 system.exe 90 PID 1448 wrote to memory of 4360 1448 system.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bb7c2979e9372d006198745f13bf5c6.exe"C:\Users\Admin\AppData\Local\Temp\2bb7c2979e9372d006198745f13bf5c6.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Roaming\system.exe"C:\Users\Admin\AppData\Roaming\system.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\system.exe" "system.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4360
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD52bb7c2979e9372d006198745f13bf5c6
SHA11c4b3f17b3d2640976d9126fdcc42344bb2b9cf3
SHA256d5673188c792f3265504fbb7fd9f01a016443b24e3f16321b92c2f8cd2781e99
SHA512c8e17bc5dca8d462f96a6bfea459f6e8c73a35978e55db2f3e34b14a221595c9ba9acf27c838b906b6ae6c66afc73967d28508da0e754ec10dfe4e26ba14b46b