Analysis
- max time kernel
141s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
Desktop_irtkes.bin.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Desktop_irtkes.bin.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target Desktop_irtkes.bin.exe
- Size 1.6MB
- Sample220107-kfa4wacad6
- SHA256 f769926334ff93842429c7eda5c7ba1dedf3fb39a4b7b47decd0cbe7b9454170
- MD5 bcfdebfd8267c37048ab2ff65a2c97fc
- SHA1 8c21b38f786b0e7f0c53f9985e207629650f556c
- SHA512 e30cd5f4666421ca8070b5cb34c6d48b1b87fecb945fde523de2f6caa04348cd21745292323f7f2b1ddf1b2156d755f83c0a0f894e324ded1dd213a0aaa9d657
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3016 DGtldt.exe 2284 DGtldt.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: DGtldt.exe File opened (read-only) \??\W: DGtldt.exe File opened (read-only) \??\L: DGtldt.exe File opened (read-only) \??\P: DGtldt.exe File opened (read-only) \??\S: DGtldt.exe File opened (read-only) \??\U: DGtldt.exe File opened (read-only) \??\F: DGtldt.exe File opened (read-only) \??\G: DGtldt.exe File opened (read-only) \??\I: DGtldt.exe File opened (read-only) \??\J: DGtldt.exe File opened (read-only) \??\Y: DGtldt.exe File opened (read-only) \??\Z: DGtldt.exe File opened (read-only) \??\H: DGtldt.exe File opened (read-only) \??\N: DGtldt.exe File opened (read-only) \??\O: DGtldt.exe File opened (read-only) \??\T: DGtldt.exe File opened (read-only) \??\R: DGtldt.exe File opened (read-only) \??\V: DGtldt.exe File opened (read-only) \??\X: DGtldt.exe File opened (read-only) \??\B: DGtldt.exe File opened (read-only) \??\E: DGtldt.exe File opened (read-only) \??\K: DGtldt.exe File opened (read-only) \??\Q: DGtldt.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\DGtldt.exe Desktop_irtkes.bin.exe File opened for modification C:\Windows\SysWOW64\DGtldt.exe Desktop_irtkes.bin.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
pid Process 3804 Desktop_irtkes.bin.exe 3016 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DGtldt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DGtldt.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\Software DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft DGtldt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie DGtldt.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" DGtldt.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1828 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe 2284 DGtldt.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3804 Desktop_irtkes.bin.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3804 Desktop_irtkes.bin.exe 3016 DGtldt.exe 2284 DGtldt.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3804 wrote to memory of 2376 3804 Desktop_irtkes.bin.exe 69 PID 3804 wrote to memory of 2376 3804 Desktop_irtkes.bin.exe 69 PID 3804 wrote to memory of 2376 3804 Desktop_irtkes.bin.exe 69 PID 3016 wrote to memory of 2284 3016 DGtldt.exe 70 PID 3016 wrote to memory of 2284 3016 DGtldt.exe 70 PID 3016 wrote to memory of 2284 3016 DGtldt.exe 70 PID 2376 wrote to memory of 1828 2376 cmd.exe 72 PID 2376 wrote to memory of 1828 2376 cmd.exe 72 PID 2376 wrote to memory of 1828 2376 cmd.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\Desktop_irtkes.bin.exe"C:\Users\Admin\AppData\Local\Temp\Desktop_irtkes.bin.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\DESKTO~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:1828
-
-
-
C:\Windows\SysWOW64\DGtldt.exeC:\Windows\SysWOW64\DGtldt.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\DGtldt.exeC:\Windows\SysWOW64\DGtldt.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2284
-