Analysis
-
max time kernel
99s -
max time network
93s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 01:48
Behavioral task
behavioral1
Sample
862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe
Resource
win10v2004-20220901-en
General
-
Target
862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe
-
Size
81KB
-
MD5
0ebe7ac38810d5c97d9906ce8932bf2c
-
SHA1
1a82bc74026e8e97103ead39fb4199b981140779
-
SHA256
862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6
-
SHA512
3020310d2ac0275c8f5545b861773948ead039335e4943bc221c462a8111aaa71c0ec468c4a199ed2252313a556e7a585ea173697b21c614d005dcfdd8ae44fd
-
SSDEEP
1536:q1DIsjedzv1GNJf9iYCOMYw1csRTytngW1NCCAN4z+t0CFfLz:q1DI8M4NpyYwmemn2Tp
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1460-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-75-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Loads dropped DLL 5 IoCs
pid Process 1460 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe 856 rundll32.exe 856 rundll32.exe 856 rundll32.exe 856 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lskyqon.dll = "C:\\Windows\\system32\\rundll32.exe C:\\Windows\\system32\\lskyqon.dll,htbsxcf" 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6065FEDA-18F9-7EE8-F5AE-00041CDE0F0E} 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\lskyqon.dll 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe File created C:\Windows\SysWOW64\evqkzue.dll 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6065FEDA-18F9-7EE8-F5AE-00041CDE0F0E} 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6065FEDA-18F9-7EE8-F5AE-00041CDE0F0E}\InprocServer32\ = "C:\\Windows\\SysWow64\\evqkzue.dll" 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6065FEDA-18F9-7EE8-F5AE-00041CDE0F0E}\InprocServer32\ThreadingModel = "Apartment" 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6065FEDA-18F9-7EE8-F5AE-00041CDE0F0E}\InprocServer32 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1460 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1460 wrote to memory of 856 1460 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe 29 PID 1460 wrote to memory of 856 1460 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe 29 PID 1460 wrote to memory of 856 1460 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe 29 PID 1460 wrote to memory of 856 1460 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe 29 PID 1460 wrote to memory of 856 1460 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe 29 PID 1460 wrote to memory of 856 1460 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe 29 PID 1460 wrote to memory of 856 1460 862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe"C:\Users\Admin\AppData\Local\Temp\862fe2efe19fb6fcb90f1eb3c01b30cece654acf3adcbbdc711165a08a18cdf6.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\lskyqon.dll,htbsxcf2⤵
- Loads dropped DLL
PID:856
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5d7c5f0ebb46d417f909d7f31885b0311
SHA129cca02c7033ae876f077146eaa673d784b13fe3
SHA256755ca5979f28c1d7c8e6994211682e17f7da9c0f206a5141d839cb8fb3641052
SHA512260970f6d6ccf9d0550bed7a31380a8891bca0dd96385d1a8597d40299a919c19deb70cad42c778c170435fd1e8b32ef7cbcd6d6580fdef0d73313cd4cffae76
-
Filesize
56KB
MD5d484ac0844a15c92cd58a39133732998
SHA1e28f9d5c1e659d28d5c0c9d72df65790dcfb9573
SHA256735299938b7a61f40b1b254b7f4ca39c9896c613f5da7639b49a089dc2f5f73b
SHA5126d67bf50910155d55e414072843db4cd31b97a3cc6f0ab47298c673885dce0d8a54e836dcab4306c8b70f2b045b82021f9d0595678ece9002b2d3f27f0f9d441
-
Filesize
48KB
MD5d7c5f0ebb46d417f909d7f31885b0311
SHA129cca02c7033ae876f077146eaa673d784b13fe3
SHA256755ca5979f28c1d7c8e6994211682e17f7da9c0f206a5141d839cb8fb3641052
SHA512260970f6d6ccf9d0550bed7a31380a8891bca0dd96385d1a8597d40299a919c19deb70cad42c778c170435fd1e8b32ef7cbcd6d6580fdef0d73313cd4cffae76
-
Filesize
48KB
MD5d7c5f0ebb46d417f909d7f31885b0311
SHA129cca02c7033ae876f077146eaa673d784b13fe3
SHA256755ca5979f28c1d7c8e6994211682e17f7da9c0f206a5141d839cb8fb3641052
SHA512260970f6d6ccf9d0550bed7a31380a8891bca0dd96385d1a8597d40299a919c19deb70cad42c778c170435fd1e8b32ef7cbcd6d6580fdef0d73313cd4cffae76
-
Filesize
48KB
MD5d7c5f0ebb46d417f909d7f31885b0311
SHA129cca02c7033ae876f077146eaa673d784b13fe3
SHA256755ca5979f28c1d7c8e6994211682e17f7da9c0f206a5141d839cb8fb3641052
SHA512260970f6d6ccf9d0550bed7a31380a8891bca0dd96385d1a8597d40299a919c19deb70cad42c778c170435fd1e8b32ef7cbcd6d6580fdef0d73313cd4cffae76
-
Filesize
48KB
MD5d7c5f0ebb46d417f909d7f31885b0311
SHA129cca02c7033ae876f077146eaa673d784b13fe3
SHA256755ca5979f28c1d7c8e6994211682e17f7da9c0f206a5141d839cb8fb3641052
SHA512260970f6d6ccf9d0550bed7a31380a8891bca0dd96385d1a8597d40299a919c19deb70cad42c778c170435fd1e8b32ef7cbcd6d6580fdef0d73313cd4cffae76