Analysis
-
max time kernel
248s -
max time network
346s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:44
Static task
static1
Behavioral task
behavioral1
Sample
144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe
Resource
win10v2004-20220901-en
General
-
Target
144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe
-
Size
138KB
-
MD5
6451caab830185967cceece215c76c13
-
SHA1
2ca0f4657a8976b344975c3532c5d043ce98ddf3
-
SHA256
144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd
-
SHA512
971ccbe668ae82a2d8dc2fb098329584ac5bf38ea8864f100f35c4d44bd3756df5d6ab01c5f6dc542bd17aaa1ddea3afb3e27b16e0e0ba9c938ceb574554656b
-
SSDEEP
3072:KTFx50VJqtHGbu5XCniylWrtGA1GHvGXaCH1Fukp1r3wQGxC:KTFoGtmiYlW4A1QvGXjBUQGxC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ilux.exepid process 1448 ilux.exe -
Loads dropped DLL 2 IoCs
Processes:
144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exepid process 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ilux.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\Currentversion\Run ilux.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\{14C469D4-4460-BB75-4ABE-72C343957D51} = "C:\\Users\\Admin\\AppData\\Roaming\\Datula\\ilux.exe" ilux.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exedescription pid process target process PID 1480 set thread context of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe -
Processes:
144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Privacy 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
ilux.exepid process 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe 1448 ilux.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.execmd.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe Token: SeSecurityPrivilege 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe Token: SeSecurityPrivilege 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe Token: SeSecurityPrivilege 772 cmd.exe Token: SeManageVolumePrivilege 1584 WinMail.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1584 WinMail.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exeilux.exedescription pid process target process PID 1480 wrote to memory of 1448 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe ilux.exe PID 1480 wrote to memory of 1448 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe ilux.exe PID 1480 wrote to memory of 1448 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe ilux.exe PID 1480 wrote to memory of 1448 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe ilux.exe PID 1448 wrote to memory of 1132 1448 ilux.exe taskhost.exe PID 1448 wrote to memory of 1132 1448 ilux.exe taskhost.exe PID 1448 wrote to memory of 1132 1448 ilux.exe taskhost.exe PID 1448 wrote to memory of 1132 1448 ilux.exe taskhost.exe PID 1448 wrote to memory of 1132 1448 ilux.exe taskhost.exe PID 1448 wrote to memory of 1192 1448 ilux.exe Dwm.exe PID 1448 wrote to memory of 1192 1448 ilux.exe Dwm.exe PID 1448 wrote to memory of 1192 1448 ilux.exe Dwm.exe PID 1448 wrote to memory of 1192 1448 ilux.exe Dwm.exe PID 1448 wrote to memory of 1192 1448 ilux.exe Dwm.exe PID 1448 wrote to memory of 1260 1448 ilux.exe Explorer.EXE PID 1448 wrote to memory of 1260 1448 ilux.exe Explorer.EXE PID 1448 wrote to memory of 1260 1448 ilux.exe Explorer.EXE PID 1448 wrote to memory of 1260 1448 ilux.exe Explorer.EXE PID 1448 wrote to memory of 1260 1448 ilux.exe Explorer.EXE PID 1448 wrote to memory of 1480 1448 ilux.exe 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe PID 1448 wrote to memory of 1480 1448 ilux.exe 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe PID 1448 wrote to memory of 1480 1448 ilux.exe 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe PID 1448 wrote to memory of 1480 1448 ilux.exe 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe PID 1448 wrote to memory of 1480 1448 ilux.exe 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe PID 1480 wrote to memory of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe PID 1480 wrote to memory of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe PID 1480 wrote to memory of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe PID 1480 wrote to memory of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe PID 1480 wrote to memory of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe PID 1480 wrote to memory of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe PID 1480 wrote to memory of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe PID 1480 wrote to memory of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe PID 1480 wrote to memory of 772 1480 144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe cmd.exe PID 1448 wrote to memory of 316 1448 ilux.exe conhost.exe PID 1448 wrote to memory of 316 1448 ilux.exe conhost.exe PID 1448 wrote to memory of 316 1448 ilux.exe conhost.exe PID 1448 wrote to memory of 316 1448 ilux.exe conhost.exe PID 1448 wrote to memory of 316 1448 ilux.exe conhost.exe PID 1448 wrote to memory of 1660 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1660 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1660 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1660 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1660 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1712 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1712 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1712 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1712 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1712 1448 ilux.exe DllHost.exe PID 1448 wrote to memory of 1584 1448 ilux.exe WinMail.exe PID 1448 wrote to memory of 1584 1448 ilux.exe WinMail.exe PID 1448 wrote to memory of 1584 1448 ilux.exe WinMail.exe PID 1448 wrote to memory of 1584 1448 ilux.exe WinMail.exe PID 1448 wrote to memory of 1584 1448 ilux.exe WinMail.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe"C:\Users\Admin\AppData\Local\Temp\144fd205af08918f076e95c1627677d6736d06864c42c2124fd6288cb8defacd.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Datula\ilux.exe"C:\Users\Admin\AppData\Roaming\Datula\ilux.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4d744a76.bat"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "18384591207301281711714364056707320209-470974169-638785921831421913-903701249"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Datula\ilux.exeFilesize
138KB
MD5c2f1782ef9318d3a03499c5e383f4085
SHA1dbf11a81f445210ba0683514b046b04631fd5385
SHA2562ec57f3a1d790469dc8a537a0442f20b3e9517173ac2c123f6b48299763a40dd
SHA5129f3d6e632866ec3440e3cf2e043e0af9bc4b54baa4180b82aa4bfb6f175d5ea832a81a1f8665ce0bd28f80b2b04b96fe566f30bd0ea42eb575b5633337aace0d
-
C:\Users\Admin\AppData\Roaming\Datula\ilux.exeFilesize
138KB
MD5c2f1782ef9318d3a03499c5e383f4085
SHA1dbf11a81f445210ba0683514b046b04631fd5385
SHA2562ec57f3a1d790469dc8a537a0442f20b3e9517173ac2c123f6b48299763a40dd
SHA5129f3d6e632866ec3440e3cf2e043e0af9bc4b54baa4180b82aa4bfb6f175d5ea832a81a1f8665ce0bd28f80b2b04b96fe566f30bd0ea42eb575b5633337aace0d
-
C:\Users\Admin\AppData\Roaming\Ycacag\piqyu.piwFilesize
398B
MD5fe8eabf6dccbce2379b3b72e0995eb12
SHA1e79ab81a798504a4678ce881b6761f664087906f
SHA25667f244957b0c93c101344cdc10112c1df76fb42c22cbf253ff7e681fd1ca3327
SHA512c46636d126b9401736d6a29f6b06e5ad9d894302393e9c2b1552d2581152580bcade624f1c82e4a8ba850d8f1941a2ea16d1cc74a3ca6ad1868644380c967623
-
\Users\Admin\AppData\Roaming\Datula\ilux.exeFilesize
138KB
MD5c2f1782ef9318d3a03499c5e383f4085
SHA1dbf11a81f445210ba0683514b046b04631fd5385
SHA2562ec57f3a1d790469dc8a537a0442f20b3e9517173ac2c123f6b48299763a40dd
SHA5129f3d6e632866ec3440e3cf2e043e0af9bc4b54baa4180b82aa4bfb6f175d5ea832a81a1f8665ce0bd28f80b2b04b96fe566f30bd0ea42eb575b5633337aace0d
-
\Users\Admin\AppData\Roaming\Datula\ilux.exeFilesize
138KB
MD5c2f1782ef9318d3a03499c5e383f4085
SHA1dbf11a81f445210ba0683514b046b04631fd5385
SHA2562ec57f3a1d790469dc8a537a0442f20b3e9517173ac2c123f6b48299763a40dd
SHA5129f3d6e632866ec3440e3cf2e043e0af9bc4b54baa4180b82aa4bfb6f175d5ea832a81a1f8665ce0bd28f80b2b04b96fe566f30bd0ea42eb575b5633337aace0d
-
memory/316-99-0x0000000000230000-0x0000000000257000-memory.dmpFilesize
156KB
-
memory/316-102-0x0000000000230000-0x0000000000257000-memory.dmpFilesize
156KB
-
memory/316-100-0x0000000000230000-0x0000000000257000-memory.dmpFilesize
156KB
-
memory/316-101-0x0000000000230000-0x0000000000257000-memory.dmpFilesize
156KB
-
memory/772-89-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/772-103-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/772-95-0x0000000000062CBA-mapping.dmp
-
memory/772-104-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/772-93-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/772-91-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/772-92-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1132-66-0x0000000001CD0000-0x0000000001CF7000-memory.dmpFilesize
156KB
-
memory/1132-65-0x0000000001CD0000-0x0000000001CF7000-memory.dmpFilesize
156KB
-
memory/1132-64-0x0000000001CD0000-0x0000000001CF7000-memory.dmpFilesize
156KB
-
memory/1132-63-0x0000000001CD0000-0x0000000001CF7000-memory.dmpFilesize
156KB
-
memory/1132-61-0x0000000001CD0000-0x0000000001CF7000-memory.dmpFilesize
156KB
-
memory/1192-70-0x0000000001AC0000-0x0000000001AE7000-memory.dmpFilesize
156KB
-
memory/1192-69-0x0000000001AC0000-0x0000000001AE7000-memory.dmpFilesize
156KB
-
memory/1192-71-0x0000000001AC0000-0x0000000001AE7000-memory.dmpFilesize
156KB
-
memory/1192-72-0x0000000001AC0000-0x0000000001AE7000-memory.dmpFilesize
156KB
-
memory/1260-76-0x00000000029F0000-0x0000000002A17000-memory.dmpFilesize
156KB
-
memory/1260-75-0x00000000029F0000-0x0000000002A17000-memory.dmpFilesize
156KB
-
memory/1260-78-0x00000000029F0000-0x0000000002A17000-memory.dmpFilesize
156KB
-
memory/1260-77-0x00000000029F0000-0x0000000002A17000-memory.dmpFilesize
156KB
-
memory/1448-57-0x0000000000000000-mapping.dmp
-
memory/1480-54-0x0000000075491000-0x0000000075493000-memory.dmpFilesize
8KB
-
memory/1480-82-0x0000000000270000-0x0000000000297000-memory.dmpFilesize
156KB
-
memory/1480-83-0x0000000000270000-0x0000000000297000-memory.dmpFilesize
156KB
-
memory/1480-84-0x0000000000270000-0x0000000000297000-memory.dmpFilesize
156KB
-
memory/1480-86-0x0000000000270000-0x0000000000297000-memory.dmpFilesize
156KB
-
memory/1480-85-0x0000000000270000-0x0000000000297000-memory.dmpFilesize
156KB
-
memory/1480-81-0x0000000000270000-0x0000000000297000-memory.dmpFilesize
156KB
-
memory/1584-117-0x000007FEFBDD1000-0x000007FEFBDD3000-memory.dmpFilesize
8KB
-
memory/1584-125-0x00000000024E0000-0x00000000024F0000-memory.dmpFilesize
64KB
-
memory/1584-119-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/1584-118-0x000007FEF67A1000-0x000007FEF67A3000-memory.dmpFilesize
8KB
-
memory/1660-109-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/1660-110-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/1660-108-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/1660-107-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/1712-114-0x0000000003880000-0x00000000038A7000-memory.dmpFilesize
156KB
-
memory/1712-115-0x0000000003880000-0x00000000038A7000-memory.dmpFilesize
156KB
-
memory/1712-116-0x0000000003880000-0x00000000038A7000-memory.dmpFilesize
156KB
-
memory/1712-113-0x0000000003880000-0x00000000038A7000-memory.dmpFilesize
156KB