9b06785cc3849340b17522965eeb9d19239be9bd006cb07988279bc4588ea982

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2023 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
Size

2.2MB
MD5

20136843871cbf97f966bd27c9522108
SHA1

96f6129e9103be1317236380079bbb3bbdb58d2d
SHA256

731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117
SHA512

2ab6a87949c11b33c8060794bee6b93c8cf668396398fa8817e59b4c8a706bfe01e3a7100cee9e575b32233624fb159cb038342ca2abfc11e46a0474b293c04b
SSDEEP

49152:Wf4JYjtvbdDUDYTSN4x1PjcvJ5dfSObPXAbVoE56ij:JI5wDYy4f7wdLbQVoEc

Score

7^/10

aspackv2 persistence spyware stealer upx

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\OqmBIi.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\OqmBIi.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

OqmBIi.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation OqmBIi.exe
Executes dropped EXE 2 IoCs

Processes:

OqmBIi.exeLodopDllInstall64.exe

pid process

1072 OqmBIi.exe
2004 LodopDllInstall64.exe
Loads dropped DLL 2 IoCs

Processes:

LodopDllInstall64.exe

pid process

2004 LodopDllInstall64.exe
2004 LodopDllInstall64.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	OqmBIi.exe

pid	process
1072	OqmBIi.exe
2004	LodopDllInstall64.exe

pid	process
2004	LodopDllInstall64.exe
2004	LodopDllInstall64.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

LodopDllInstall64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ = "C:\\PROGRA~2\\MOUNTT~1\\Lodop\\CAOSOF~1.OCX"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ThreadingModel = "Apartment"	LodopDllInstall64.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5024-138-0x0000000000400000-0x0000000000B8C000-memory.dmp	upx
behavioral2/memory/5024-194-0x0000000000400000-0x0000000000B8C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

OqmBIi.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OqmBIi.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	OqmBIi.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	OqmBIi.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	OqmBIi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	OqmBIi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	OqmBIi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0"	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0"	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe

Modifies registry class 64 IoCs

Processes:

LodopDllInstall64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ = "LodopX Control"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\ = "LodopX Control"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\HELPDIR\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\FLAGS\ = "2"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\1	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\CAOSOFT_WEB_PRINT_lodop64.ocx,0"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0\win32\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\CAOSOFT_WEB_PRINT_lodop64.ocx"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ = "C:\\PROGRA~2\\MOUNTT~1\\Lodop\\CAOSOF~1.OCX"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\1\ = "205201"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version\ = "6.0"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Control	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\Clsid	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Control\	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\HELPDIR	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\ = "0"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\FLAGS	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ThreadingModel = "Apartment"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID\ = "Lodop.LodopX"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0\ = "Properties,0,2"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\Clsid\ = "{2105C259-1E0C-4534-8141-A753534CB4CA}"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\ = "Lodop"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0\win32	LodopDllInstall64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX"	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}	LodopDllInstall64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib	LodopDllInstall64.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe

pid	process
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe

pid	process
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exeOqmBIi.exe

description	pid	process	target process
PID 5024 wrote to memory of 1072	5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe	OqmBIi.exe
PID 5024 wrote to memory of 1072	5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe	OqmBIi.exe
PID 5024 wrote to memory of 1072	5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe	OqmBIi.exe
PID 5024 wrote to memory of 2004	5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe	LodopDllInstall64.exe
PID 5024 wrote to memory of 2004	5024	731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe	LodopDllInstall64.exe
PID 1072 wrote to memory of 2124	1072	OqmBIi.exe	cmd.exe
PID 1072 wrote to memory of 2124	1072	OqmBIi.exe	cmd.exe
PID 1072 wrote to memory of 2124	1072	OqmBIi.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe
"C:\Users\Admin\AppData\Local\Temp\731e1a498611e33e76f3e69386fd70281168da539d0005212bc3bd4d0ce1b117.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\OqmBIi.exe
C:\Users\Admin\AppData\Local\Temp\OqmBIi.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7a6648fc.bat" "
3⤵
PID:2124

C:\Program Files (x86)\MountTaiSoftware\Lodop\LodopDllInstall64.exe
"C:\Program Files (x86)\MountTaiSoftware\Lodop\LodopDllInstall64.exe" CAOSOFT_WEB_PRINT_lodop64.ocx
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop64.ocx
Filesize
6.0MB

MD5
167734e8f770e73bd8baf046caff17d6

SHA1
e84dac6c9cc7d4a42635cae46941e55c637b3e3d

SHA256
311eef48ed6ed5e930f193b3f62e45d91a075ac4c80b315b18add79e57a867a0

SHA512
aab9ef67c3a476974f7003f9c90806c76a220e9c9f1b62c65a1bc8f8b86e188d88dbb4f0476a2bcd658e06898576197c34c0cff3f66633a7f26316bae6635bc1

Download Submit
C:\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop64.ocx
Filesize
6.0MB

MD5
167734e8f770e73bd8baf046caff17d6

SHA1
e84dac6c9cc7d4a42635cae46941e55c637b3e3d

SHA256
311eef48ed6ed5e930f193b3f62e45d91a075ac4c80b315b18add79e57a867a0

SHA512
aab9ef67c3a476974f7003f9c90806c76a220e9c9f1b62c65a1bc8f8b86e188d88dbb4f0476a2bcd658e06898576197c34c0cff3f66633a7f26316bae6635bc1

Download Submit
C:\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop64.ocx
Filesize
6.0MB

MD5
167734e8f770e73bd8baf046caff17d6

SHA1
e84dac6c9cc7d4a42635cae46941e55c637b3e3d

SHA256
311eef48ed6ed5e930f193b3f62e45d91a075ac4c80b315b18add79e57a867a0

SHA512
aab9ef67c3a476974f7003f9c90806c76a220e9c9f1b62c65a1bc8f8b86e188d88dbb4f0476a2bcd658e06898576197c34c0cff3f66633a7f26316bae6635bc1

Download Submit
C:\Program Files (x86)\MountTaiSoftware\Lodop\LodopDllInstall64.exe
Filesize
475KB

MD5
129c19761074529f21e9b58760018538

SHA1
dc44d7184927adcb7ae2d509a56624f320c0ce94

SHA256
27b84c2b92bbea719f96769cfa287b94a48ab13c7c3ba6c4907a1886f3a6940a

SHA512
3dabfdda728aa6db59f5499b2500cecc7e332bef899f2c728213d48d96eee9fefa8720c91597c8223be4b1631ec0211c17c6d546f2ea330b7c458bdb56fc224e

Download Submit
C:\Program Files (x86)\MountTaiSoftware\Lodop\LodopDllInstall64.exe
Filesize
475KB

MD5
129c19761074529f21e9b58760018538

SHA1
dc44d7184927adcb7ae2d509a56624f320c0ce94

SHA256
27b84c2b92bbea719f96769cfa287b94a48ab13c7c3ba6c4907a1886f3a6940a

SHA512
3dabfdda728aa6db59f5499b2500cecc7e332bef899f2c728213d48d96eee9fefa8720c91597c8223be4b1631ec0211c17c6d546f2ea330b7c458bdb56fc224e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\k2[1].rar
Filesize
4B

MD5
d3b07384d113edec49eaa6238ad5ff00

SHA1
f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

SHA256
b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

SHA512
0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\408823A0.exe
Filesize
4B

MD5
20879c987e2f9a916e578386d499f629

SHA1
c7b33ddcc42361fdb847036fc07e880b81935d5d

SHA256
9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

SHA512
bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a6648fc.bat
Filesize
187B

MD5
463c15808e0883233e1d898dd25c3ca9

SHA1
5d4380feed832695ca4bdcc9d957cfd7164e5429

SHA256
f43769876752e1223748daff87ae1ccd9a8fe3a1c80331b924244bd1c8f063c2

SHA512
63af9f7f25422bc9b50265a30763ce7c5b6c30c898bf48854d574c5fd47ad680cd4da3030f0e36b1440e348685e3ace3479349ee808883df9100b86fd7c3c97c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OqmBIi.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OqmBIi.exe
Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/1072-141-0x0000000000DC0000-0x0000000000DC9000-memory.dmp

Filesize
36KB

Download
memory/1072-192-0x0000000000DC0000-0x0000000000DC9000-memory.dmp

Filesize
36KB

Download
memory/2004-155-0x0000000002240000-0x0000000002855000-memory.dmp

Filesize
6.1MB

Download
memory/2004-157-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2004-164-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/5024-145-0x0000000002A70000-0x0000000002A71000-memory.dmp

Filesize
4KB

Download
memory/5024-138-0x0000000000400000-0x0000000000B8C000-memory.dmp

Filesize
7.5MB

Download
memory/5024-194-0x0000000000400000-0x0000000000B8C000-memory.dmp

Filesize
7.5MB

Download