Analysis
- max time kernel
143s - max time network
149s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
07/01/2022, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
Desktop_irtkes.bin.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Desktop_irtkes.bin.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target Desktop_irtkes.bin.exe
- Size 1.6MB
- Sample220107-kfa4wacad6
- SHA256 f769926334ff93842429c7eda5c7ba1dedf3fb39a4b7b47decd0cbe7b9454170
- MD5 bcfdebfd8267c37048ab2ff65a2c97fc
- SHA1 8c21b38f786b0e7f0c53f9985e207629650f556c
- SHA512 e30cd5f4666421ca8070b5cb34c6d48b1b87fecb945fde523de2f6caa04348cd21745292323f7f2b1ddf1b2156d755f83c0a0f894e324ded1dd213a0aaa9d657
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 652 DGtldt.exe 1748 DGtldt.exe - Deletes itself 1 IoCs
pid Process 1424 cmd.exe - Loads dropped DLL 1 IoCs
pid Process 652 DGtldt.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: DGtldt.exe File opened (read-only) \??\K: DGtldt.exe File opened (read-only) \??\R: DGtldt.exe File opened (read-only) \??\V: DGtldt.exe File opened (read-only) \??\W: DGtldt.exe File opened (read-only) \??\X: DGtldt.exe File opened (read-only) \??\Z: DGtldt.exe File opened (read-only) \??\B: DGtldt.exe File opened (read-only) \??\F: DGtldt.exe File opened (read-only) \??\N: DGtldt.exe File opened (read-only) \??\Q: DGtldt.exe File opened (read-only) \??\G: DGtldt.exe File opened (read-only) \??\I: DGtldt.exe File opened (read-only) \??\S: DGtldt.exe File opened (read-only) \??\T: DGtldt.exe File opened (read-only) \??\U: DGtldt.exe File opened (read-only) \??\E: DGtldt.exe File opened (read-only) \??\H: DGtldt.exe File opened (read-only) \??\L: DGtldt.exe File opened (read-only) \??\M: DGtldt.exe File opened (read-only) \??\O: DGtldt.exe File opened (read-only) \??\P: DGtldt.exe File opened (read-only) \??\Y: DGtldt.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DGtldt.exe Desktop_irtkes.bin.exe File created C:\Windows\SysWOW64\DGtldt.exe Desktop_irtkes.bin.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
pid Process 288 Desktop_irtkes.bin.exe 288 Desktop_irtkes.bin.exe 652 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DGtldt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DGtldt.exe - Modifies data under HKEY_USERS 12 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings DGtldt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections DGtldt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings DGtldt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\Software DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie DGtldt.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1688 PING.EXE - Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe 1748 DGtldt.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 288 Desktop_irtkes.bin.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 288 Desktop_irtkes.bin.exe 652 DGtldt.exe 1748 DGtldt.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 288 wrote to memory of 1424 288 Desktop_irtkes.bin.exe 28 PID 288 wrote to memory of 1424 288 Desktop_irtkes.bin.exe 28 PID 288 wrote to memory of 1424 288 Desktop_irtkes.bin.exe 28 PID 288 wrote to memory of 1424 288 Desktop_irtkes.bin.exe 28 PID 652 wrote to memory of 1748 652 DGtldt.exe 30 PID 652 wrote to memory of 1748 652 DGtldt.exe 30 PID 652 wrote to memory of 1748 652 DGtldt.exe 30 PID 652 wrote to memory of 1748 652 DGtldt.exe 30 PID 1424 wrote to memory of 1688 1424 cmd.exe 31 PID 1424 wrote to memory of 1688 1424 cmd.exe 31 PID 1424 wrote to memory of 1688 1424 cmd.exe 31 PID 1424 wrote to memory of 1688 1424 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Desktop_irtkes.bin.exe"C:\Users\Admin\AppData\Local\Temp\Desktop_irtkes.bin.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\DESKTO~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:1688
-
-
-
C:\Windows\SysWOW64\DGtldt.exeC:\Windows\SysWOW64\DGtldt.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\DGtldt.exeC:\Windows\SysWOW64\DGtldt.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1748
-