ba18ff142bae31457031ca49e772b10792ad3a5bdead90cb2c1d37e2a6c2fd59

Resubmissions

12-06-2024 08:39

240612-kkjltawejn 10

13-04-2024 00:14

240413-ajfhnagf98 10

Analysis

max time kernel
105s
max time network
71s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-04-2024 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware-Feed-master/2020.08.19_CISA-North_Korean_RAT_BLINDINGCAN/README.md
Size

57B
MD5

0272f462b25073e0228d87c39ed15eb3
SHA1

8c3de1da5c8660f872dff926a8784f2fa651eda4
SHA256

80eaf28ff86838e322a4413f90c055151615a42fd0ad4d665201271684b9c06c
SHA512

2a12b4fc21ad5eb65c75df83918b30f5028f10bd688a36a850b67a1cef76de3dac65177124e920ed8085f930173dfc414c773332dead677dda98e64efe33cb9d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\md_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2424 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2424 AcroRd32.exe
2424 AcroRd32.exe

pid	process
2424	AcroRd32.exe

pid	process
2424	AcroRd32.exe
2424	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2612 wrote to memory of 2580	2612	cmd.exe	rundll32.exe
PID 2612 wrote to memory of 2580	2612	cmd.exe	rundll32.exe
PID 2612 wrote to memory of 2580	2612	cmd.exe	rundll32.exe
PID 2580 wrote to memory of 2424	2580	rundll32.exe	AcroRd32.exe
PID 2580 wrote to memory of 2424	2580	rundll32.exe	AcroRd32.exe
PID 2580 wrote to memory of 2424	2580	rundll32.exe	AcroRd32.exe
PID 2580 wrote to memory of 2424	2580	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Malware-Feed-master\2020.08.19_CISA-North_Korean_RAT_BLINDINGCAN\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Malware-Feed-master\2020.08.19_CISA-North_Korean_RAT_BLINDINGCAN\README.md
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Malware-Feed-master\2020.08.19_CISA-North_Korean_RAT_BLINDINGCAN\README.md"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2424

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
cfcc3c5350c88fac39c973fe2b15d138

SHA1
2c412cb1262f2536a6e94d04a1b82650d17da71d

SHA256
1d9e34e0abf4d392a38205fe43a72bda040fd359729ded5d49b2f01d95daaf54

SHA512
2d083e5064e8fe6e7e7956906f8a78fe4257037d87dcc062c35962f2cb00f182c2d85c6c0c6f94dcd60ab3793fd441fbaf39942840aefde6cec2b354591cb08a

Download Submit