75b7bddef1a15ec5831eeb5abc12341bf4322456909906a81ffc62ef8d955d81

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/coyote.exe
Size

50KB
MD5

07b54aa737d16f89c80e6da5a2de5013
SHA1

bcad8a5a09597086ce2df3ed4d833ca6a188f12e
SHA256

e4ee0e4c5533fad0ece32849b37dec5c22ad662ce3dd1376880200eb6011de5f
SHA512

e92ed0a39dd645c60319739b86a06e7643cfb14f28eb6d1bb3ec97febf0405eb5ad4d3e6aaf3374bfebdeb1bbfa1371764790810aa904f1cd9f63b17c62fbe61
SSDEEP

768:EsPebzrf3MbrOcnT9c/onP99Fg7APq+As006t++yD:O3MXr99nP9zgsD100x+

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

Processes:

coyote.exe

description ioc process

File opened for modification C:\Windows\win.ini coyote.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

coyote.exe

pid process

2296 coyote.exe
2296 coyote.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

coyote.exe

pid process

2296 coyote.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	coyote.exe

pid	process
2296	coyote.exe
2296	coyote.exe

pid	process
2296	coyote.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

coyote.execmd.exe

description	pid	process	target process
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 2296 wrote to memory of 3832	2296	coyote.exe	cmd.exe
PID 3832 wrote to memory of 2396	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 2396	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 2396	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 2396	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 3652	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 3652	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 3652	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 3652	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4080	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4080	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4080	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4080	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 5016	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 5016	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 5016	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 5016	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4868	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4868	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4868	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4868	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4912	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4912	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4912	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 4912	3832	cmd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\coyote.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\coyote.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2296

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Identities\{44AD66B3-9B70-40C2-B12A-80E14087D31B}\odbcad32.exe""
3⤵
PID:2396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Identities\{44AD66B3-9B70-40C2-B12A-80E14087D31B}\odbcad32.exe""
3⤵
PID:3652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Identities\{44AD66B3-9B70-40C2-B12A-80E14087D31B}\odbcad32.exe""
3⤵
PID:4080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Identities\{44AD66B3-9B70-40C2-B12A-80E14087D31B}\odbcad32.exe""
3⤵
PID:5016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Identities\{44AD66B3-9B70-40C2-B12A-80E14087D31B}\odbcad32.exe""
3⤵
PID:4868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Identities\{44AD66B3-9B70-40C2-B12A-80E14087D31B}\odbcad32.exe""
3⤵
PID:4912

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini
Filesize
517B

MD5
893cae59ab5945a94a7da007d47a1255

SHA1
d4cfd81c6647ca64022bd307c08a7fb4bbbd4c06

SHA256
edfa0f2d3bea9f737e0315971c6f81d3d8e7d460b60a19351ada0316a093c938

SHA512
d66e454781f54f45df814ad32d687b0f100578c2a4ffca62de81add04281fb881a550702bd2d058933d3736d14e88624af268a86ce24b0c3935242b206ffdcc9

Download Submit
memory/2296-46-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/2296-45-0x0000000000030000-0x0000000000034000-memory.dmp

Filesize
16KB

Download
memory/2296-0-0x00000000000B0000-0x00000000000B6000-memory.dmp

Filesize
24KB

Download
memory/2296-10007-0x0000000000120000-0x0000000000142000-memory.dmp

Filesize
136KB

Download
memory/3832-10008-0x0000000000090000-0x0000000000096000-memory.dmp

Filesize
24KB

Download