Analysis
-
max time kernel
101s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:59
Static task
static1
Behavioral task
behavioral1
Sample
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe
Resource
win10v2004-20220812-en
General
-
Target
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe
-
Size
45KB
-
MD5
4bc849538b01eb61b47c3432c13482e0
-
SHA1
232c7dddcbb3cac9db72c2fa446c5cd39bb35a13
-
SHA256
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767
-
SHA512
362787d9d11ba8c50835050c39b6aa2946f2112bdb4eecc2b6c3bee23fcb786479431210bfba0e95600f684e9c0e917054e62f1df9995435f12bda983d22f7ce
-
SSDEEP
768:nm+G8YMyvdQrvJsnkgJFnvQ4BONDX0rnskgBorVzRHyGnRC2/1H5Vi:nmjxvOzCvvo4BcX01gBorVzciCc
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
Processes:
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe -
Executes dropped EXE 1 IoCs
Processes:
Obikbgbb.exepid process 5056 Obikbgbb.exe -
Drops file in System32 directory 3 IoCs
Processes:
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exedescription ioc process File created C:\Windows\SysWOW64\Lfghpbcp.dll b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe File created C:\Windows\SysWOW64\Obikbgbb.exe b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe File opened for modification C:\Windows\SysWOW64\Obikbgbb.exe b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
Obikbgbb.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess Obikbgbb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess = "yes" Obikbgbb.exe -
Modifies registry class 6 IoCs
Processes:
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfghpbcp.dll" b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Obikbgbb.exepid process 5056 Obikbgbb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exedescription pid process target process PID 488 wrote to memory of 5056 488 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Obikbgbb.exe PID 488 wrote to memory of 5056 488 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Obikbgbb.exe PID 488 wrote to memory of 5056 488 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Obikbgbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe"C:\Users\Admin\AppData\Local\Temp\b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Obikbgbb.exeC:\Windows\system32\Obikbgbb.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Obikbgbb.exeFilesize
45KB
MD5d5a9fef2d38708e7bc391a063a1d7989
SHA118b69095c4c8a4aeb965dee638df71579864ff62
SHA2562615bf9b97c582bba735b032f07235f31d9a2475630bbdd58b6e537eba15b0d4
SHA51264bbf1f2e4c40e8833e1cbd5ccff0a1817e392a99d176f73d27c47ae96528fd6e82ad92ffdaefc371b83d0355afb246296c580523ea158ef99637d7eb940500d
-
C:\Windows\SysWOW64\Obikbgbb.exeFilesize
45KB
MD5d5a9fef2d38708e7bc391a063a1d7989
SHA118b69095c4c8a4aeb965dee638df71579864ff62
SHA2562615bf9b97c582bba735b032f07235f31d9a2475630bbdd58b6e537eba15b0d4
SHA51264bbf1f2e4c40e8833e1cbd5ccff0a1817e392a99d176f73d27c47ae96528fd6e82ad92ffdaefc371b83d0355afb246296c580523ea158ef99637d7eb940500d
-
memory/488-132-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/488-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5056-133-0x0000000000000000-mapping.dmp
-
memory/5056-136-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/5056-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB