Overview

overview

10

Static

static

ee661dd8e1...c4.exe

windows7-x64

8

ee661dd8e1...c4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    186s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 14:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ee661dd8e13b6039457221c08dceb15576f9d6b4e99dc173b5ab32c7a1538cc4.exe

  • Size

    361KB

  • MD5

    49f5bef87fc96acfded2371efc06fec6

  • SHA1

    2ba93a292f4fe3f0f2b3da3a7ba46e45b509b3bd

  • SHA256

    ee661dd8e13b6039457221c08dceb15576f9d6b4e99dc173b5ab32c7a1538cc4

  • SHA512

    4d15f106d5e16652398448881c3582be8bf01cdffb99daa0818dc6cf70426f1fc844b7c81cc8454a95eb569a5862e8505e5c2d5f2ded6577dd3f0f11348d2ad8

  • SSDEEP

    6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
  • Executes dropped EXE 15 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee661dd8e13b6039457221c08dceb15576f9d6b4e99dc173b5ab32c7a1538cc4.exe
    "C:\Users\Admin\AppData\Local\Temp\ee661dd8e13b6039457221c08dceb15576f9d6b4e99dc173b5ab32c7a1538cc4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Temp\ztrljdbwtomgeywq.exe
      C:\Temp\ztrljdbwtomgeywq.exe run
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nlfdxvpnif.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3932
        • C:\Temp\nlfdxvpnif.exe
          C:\Temp\nlfdxvpnif.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1880
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3844
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3988
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpnif.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3144
        • C:\Temp\i_nlfdxvpnif.exe
          C:\Temp\i_nlfdxvpnif.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1668
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\lfdxvqnifa.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4592
        • C:\Temp\lfdxvqnifa.exe
          C:\Temp\lfdxvqnifa.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4544
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1448
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4928
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_lfdxvqnifa.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1292
        • C:\Temp\i_lfdxvqnifa.exe
          C:\Temp\i_lfdxvqnifa.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4668
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mgeywqojgb.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3964
        • C:\Temp\mgeywqojgb.exe
          C:\Temp\mgeywqojgb.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4208
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1760
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_mgeywqojgb.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3248
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4304
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4304 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2184
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3864

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit

  • C:\Temp\i_lfdxvqnifa.exe
    Filesize

    361KB

    MD5

    5be8e9c63082d8e863492cccd13b3d24

    SHA1

    1b215f56b95464efaa1ee6e0b6d22a290d949954

    SHA256

    2577ef43b16ffb6f3a56cef0360300eb621b2a623170461ae256efe3648c558e

    SHA512

    8daa98d5b56f29837db937261ac3f4a76ca8cddfa9f7ed0d70e8ef0c38f994d0d8f3e5a4952c39bf7f604d9da1e736a1d874f94a7102f3254291acbe955bd089

    Download Submit

  • C:\Temp\i_lfdxvqnifa.exe
    Filesize

    361KB

    MD5

    5be8e9c63082d8e863492cccd13b3d24

    SHA1

    1b215f56b95464efaa1ee6e0b6d22a290d949954

    SHA256

    2577ef43b16ffb6f3a56cef0360300eb621b2a623170461ae256efe3648c558e

    SHA512

    8daa98d5b56f29837db937261ac3f4a76ca8cddfa9f7ed0d70e8ef0c38f994d0d8f3e5a4952c39bf7f604d9da1e736a1d874f94a7102f3254291acbe955bd089

    Download Submit

  • C:\Temp\i_nlfdxvpnif.exe
    Filesize

    361KB

    MD5

    be6a93e66bb76dd7bd12ba25a335ca2c

    SHA1

    ba39f720013cdead86685ec54851ec964c59e5fc

    SHA256

    1c54b9f87604045cfae75f537b1ba5cfbb40bd2442c016f1d11c177c0d29196f

    SHA512

    b687a4ac91943ff320087e1d1103c96b13e262f8727b8c72929324967cf84797ee3c90c80193a73e452a9572d54590009da914eb41f2f6569f5dc5e222be8cab

    Download Submit

  • C:\Temp\i_nlfdxvpnif.exe
    Filesize

    361KB

    MD5

    be6a93e66bb76dd7bd12ba25a335ca2c

    SHA1

    ba39f720013cdead86685ec54851ec964c59e5fc

    SHA256

    1c54b9f87604045cfae75f537b1ba5cfbb40bd2442c016f1d11c177c0d29196f

    SHA512

    b687a4ac91943ff320087e1d1103c96b13e262f8727b8c72929324967cf84797ee3c90c80193a73e452a9572d54590009da914eb41f2f6569f5dc5e222be8cab

    Download Submit

  • C:\Temp\lfdxvqnifa.exe
    Filesize

    361KB

    MD5

    53849535fa5201866e08325f39e69a8e

    SHA1

    13b1086020d696e9b35e1be26ce078e8f47c2f02

    SHA256

    d41477e407ebf89945730461dde2e5daaeb2fa8a0b3cd5714d2a9c44172c7a0d

    SHA512

    9476ea5ffdbed592152018a57a540cab47c083fcd3844d8f4b74941c1a264cf7e01297774de2bb92d4f8857ca2ac6595053be910327f0c016a66841a28605b06

    Download Submit

  • C:\Temp\lfdxvqnifa.exe
    Filesize

    361KB

    MD5

    53849535fa5201866e08325f39e69a8e

    SHA1

    13b1086020d696e9b35e1be26ce078e8f47c2f02

    SHA256

    d41477e407ebf89945730461dde2e5daaeb2fa8a0b3cd5714d2a9c44172c7a0d

    SHA512

    9476ea5ffdbed592152018a57a540cab47c083fcd3844d8f4b74941c1a264cf7e01297774de2bb92d4f8857ca2ac6595053be910327f0c016a66841a28605b06

    Download Submit

  • C:\Temp\mgeywqojgb.exe
    Filesize

    361KB

    MD5

    38afa5b5be31f327f9c61dd96743fccb

    SHA1

    f30982e2e4fa1d6c3ad8d28ff239db73f3ae0fd3

    SHA256

    4fffc13185af6d09ec99a4be17a6b31c4e005d846dcad4a6a34c5764beec230d

    SHA512

    4a2b212c52a298ec068d54c468ca6bc4e4dedd0a511b593be51bea46ecbf3591e578d7a75e0a0cfefd94bfe62c909b684ee7c925b2b514bb05f57a6ff1fa776e

    Download Submit

  • C:\Temp\mgeywqojgb.exe
    Filesize

    361KB

    MD5

    38afa5b5be31f327f9c61dd96743fccb

    SHA1

    f30982e2e4fa1d6c3ad8d28ff239db73f3ae0fd3

    SHA256

    4fffc13185af6d09ec99a4be17a6b31c4e005d846dcad4a6a34c5764beec230d

    SHA512

    4a2b212c52a298ec068d54c468ca6bc4e4dedd0a511b593be51bea46ecbf3591e578d7a75e0a0cfefd94bfe62c909b684ee7c925b2b514bb05f57a6ff1fa776e

    Download Submit

  • C:\Temp\nlfdxvpnif.exe
    Filesize

    361KB

    MD5

    dcc88fe00a2d13a15ec714f144e0ec9e

    SHA1

    2fb4995d6848a6de60ecbe56e487cf60e0b0cb92

    SHA256

    a2ef8f9d7f7fcff29b09ffd601d031af91e0875ef21bff2f79c5e67de87ba89d

    SHA512

    1cf89fe496f9e65ecb0ba62ca8e8715d1b8b1be0beaf615516f6eb3da439d70e45fad384e8852adad821f4e484fd2b263693f79bc79327469f8e7aeaeb62bb7b

    Download Submit

  • C:\Temp\nlfdxvpnif.exe
    Filesize

    361KB

    MD5

    dcc88fe00a2d13a15ec714f144e0ec9e

    SHA1

    2fb4995d6848a6de60ecbe56e487cf60e0b0cb92

    SHA256

    a2ef8f9d7f7fcff29b09ffd601d031af91e0875ef21bff2f79c5e67de87ba89d

    SHA512

    1cf89fe496f9e65ecb0ba62ca8e8715d1b8b1be0beaf615516f6eb3da439d70e45fad384e8852adad821f4e484fd2b263693f79bc79327469f8e7aeaeb62bb7b

    Download Submit

  • C:\Temp\ztrljdbwtomgeywq.exe
    Filesize

    361KB

    MD5

    c189eb791b61242c1c89895b3f8c08e1

    SHA1

    ff05500f959c30c0945a627c880de6e9fabc4af8

    SHA256

    127c5b44850c583457bf2f6fb5ad1ab04c69d97bef122a2457a5c40297d02e46

    SHA512

    1e734c898504fc20ef8d25ba51cf4a60933c8f7bb3030870e6fa4b85765b2da34737ba7e8ba5be74113c9e4928e504cb50cdf80d3744a15af20a1b2c6bd6523d

    Download Submit

  • C:\Temp\ztrljdbwtomgeywq.exe
    Filesize

    361KB

    MD5

    c189eb791b61242c1c89895b3f8c08e1

    SHA1

    ff05500f959c30c0945a627c880de6e9fabc4af8

    SHA256

    127c5b44850c583457bf2f6fb5ad1ab04c69d97bef122a2457a5c40297d02e46

    SHA512

    1e734c898504fc20ef8d25ba51cf4a60933c8f7bb3030870e6fa4b85765b2da34737ba7e8ba5be74113c9e4928e504cb50cdf80d3744a15af20a1b2c6bd6523d

    Download Submit

  • C:\temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    73cb073e13542fb21ae8f465fd20f03b

    SHA1

    8887204637744e2869f7442ff1fda7fa20145626

    SHA256

    d4194b96c1fdf8010a5511eeb0bc6972e32dfb2ccf6789d74a6608cf535ff39a

    SHA512

    023a1012f8ad0dcc79f007b791d32755c6820ccdbceb7c4f31c73094fb7c323484f83168eefe41accf3351b2fbe8876a1ea826c68edba12a994ca5b96e0c1b21

    Download Submit