Overview

overview

10

Static

static

7

90a24a5db1...59.exe

windows7-x64

10

90a24a5db1...59.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2023 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759.exe

  • Size

    5.6MB

  • MD5

    59a6cf429b04e27edf026dc9d6c401f5

  • SHA1

    68aa9842635605fbc86c99ed66574ff5dbfa4cb5

  • SHA256

    90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759

  • SHA512

    5396a444e48d49573312905d408210bef5821faad01ace19568465c1e8e5ea10e4ae91111e3ac8cbcf9621ad28673f35979718bba2fe833ef6260aaaf6fc2b63

  • SSDEEP

    98304:AaPlXklTveze0Wl1AeDcn2BlJPD8Nzl2bT8mRaw8GFvuztrxcwmMQ:VR23tnt8NPLwJ+VfmM

Score
10/10
adwareevasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Drops file in Drivers directory 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 28 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 3 IoCs
    stealer
  • Modifies registry class 25 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759.exe
    "C:\Users\Admin\AppData\Local\Temp\90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759.exe"
    1⤵
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759.exe
      C:\Users\Admin\AppData\Local\Temp\90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759.exe /nstart
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:5100
    • C:\Users\Admin\AppData\Local\Temp\bqyfemf.exe
      C:\Users\Admin\AppData\Local\Temp\bqyfemf.exe /HomeRegAccess10
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2844
    • C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe
      C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn setowner -ownr "n:Administrators"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      PID:1468
    • C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe
      C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      PID:4016
    • C:\Users\Admin\AppData\Local\Temp\lndondk.exe
      C:\Users\Admin\AppData\Local\Temp\lndondk.exe /HomeRegAccess10
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1872
    • C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe
      C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe -on "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN" -ot reg -actn ace -ace "n:Everyone;p:full;i:np;m:set" -rec no
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      PID:4720
    • C:\Windows\SYSTEM32\Rundll32.exe
      Rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\Users\Admin\AppData\Local\Temp\~dlooezx.inf
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Windows\system32\runonce.exe
        "C:\Windows\system32\runonce.exe" -r
        3⤵
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Windows\System32\grpconv.exe
          "C:\Windows\System32\grpconv.exe" -o
          4⤵
            PID:1924
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\huME2LL.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1804
        • C:\Windows\system32\PING.EXE
          ping -n 1 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:5108
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vVLELAI.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Windows\system32\PING.EXE
          ping -n 1 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:3036

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Browser Extensions

    1
    T1176

    Privilege Escalation

    Bypass User Account Control

    1
    T1088

    Defense Evasion

    Bypass User Account Control

    1
    T1088

    Disabling Security Tools

    1
    T1089

    Modify Registry

    6
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    4
    T1082

    Peripheral Device Discovery

    1
    T1120

    Remote System Discovery

    1
    T1018

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5100ikfvxcw
      Filesize

      392KB

      MD5

      db7a38e7da6b7ac5c06fe9f1fe6db1d1

      SHA1

      e652b9938988192919eb5f98aed33c47b787559e

      SHA256

      9b6f03211f080e379ff476c55b447f5ddb4c6ba0efba91963405c95852009b5f

      SHA512

      0fea6dd05048ab83ad018b4d41f221d3d60131422751d41678a11e889a0b005b2d5ac4f9b088958c7594f9574dd96652c9307d05e2a9fb4a1961ea10d770ca0a

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\aut8235.tmp
      Filesize

      76KB

      MD5

      92401b81f77ff322e2c4b6b587fe8d28

      SHA1

      fdc2840a018653f69426d4d31ace2b19c29e8364

      SHA256

      53a1d227591f430b09dcbf953120c8892a2f41e95d4d726c23e36dd07cb979eb

      SHA512

      20ecd667e2e04ee16ccd20bab41fd5f2ea1097c6022c4cafff6560956d7aefdc8576fd119061cf2c2eab6c8bba272bfc09c520075c1062eaeb44ac3801c4dcca

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\bqyfemf.exe
      Filesize

      5.6MB

      MD5

      59a6cf429b04e27edf026dc9d6c401f5

      SHA1

      68aa9842635605fbc86c99ed66574ff5dbfa4cb5

      SHA256

      90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759

      SHA512

      5396a444e48d49573312905d408210bef5821faad01ace19568465c1e8e5ea10e4ae91111e3ac8cbcf9621ad28673f35979718bba2fe833ef6260aaaf6fc2b63

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\bqyfemf.exe
      Filesize

      5.6MB

      MD5

      59a6cf429b04e27edf026dc9d6c401f5

      SHA1

      68aa9842635605fbc86c99ed66574ff5dbfa4cb5

      SHA256

      90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759

      SHA512

      5396a444e48d49573312905d408210bef5821faad01ace19568465c1e8e5ea10e4ae91111e3ac8cbcf9621ad28673f35979718bba2fe833ef6260aaaf6fc2b63

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\huME2LL.bat
      Filesize

      689B

      MD5

      b31ebc599c157330298f521f2627836d

      SHA1

      b10a69e90c548b6ec4c60fd53ee833aa46076f81

      SHA256

      9759d4f9867ad6eef8960579f800d4713c1a9d6a0f9db5af9934b021ff5075be

      SHA512

      9eb93bf7563fc4c61f4c60c316ac8c9a065f16e5f592d28e6973f0a1e41f1bd1cd0050ad20bf0864da0931d02e4bc43e699584ca278e1e7316519f158af5b66d

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\lndondk.exe
      Filesize

      5.6MB

      MD5

      59a6cf429b04e27edf026dc9d6c401f5

      SHA1

      68aa9842635605fbc86c99ed66574ff5dbfa4cb5

      SHA256

      90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759

      SHA512

      5396a444e48d49573312905d408210bef5821faad01ace19568465c1e8e5ea10e4ae91111e3ac8cbcf9621ad28673f35979718bba2fe833ef6260aaaf6fc2b63

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\lndondk.exe
      Filesize

      5.6MB

      MD5

      59a6cf429b04e27edf026dc9d6c401f5

      SHA1

      68aa9842635605fbc86c99ed66574ff5dbfa4cb5

      SHA256

      90a24a5db1c52046ff692ab44943d860987eb2508dca6d112e4af59f6c99f759

      SHA512

      5396a444e48d49573312905d408210bef5821faad01ace19568465c1e8e5ea10e4ae91111e3ac8cbcf9621ad28673f35979718bba2fe833ef6260aaaf6fc2b63

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\vVLELAI.bat
      Filesize

      465B

      MD5

      94027a1080a24669846f7ca39290addf

      SHA1

      c08d46bcbc6dd5b7769535eb6faba2e914a0476f

      SHA256

      aae9a4524105c8e567f50fc2ab2114cde4e540aa3e0c53ce6fe09040ffe64e04

      SHA512

      c87d48db2b8009bce03c8accb236aa74297b395a9e524451bae347cf4b2c69d3ae6ca4732d5f296662e4c7e3ed39510d7fe54caaff470a1cd4e88fdb2ca17e60

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\~dlooezx.inf
      Filesize

      32B

      MD5

      8f5f4837dd4a1680d79bbdca9cc1e08f

      SHA1

      688b5d5ef993733b97b303ed4c8409a14b230de5

      SHA256

      2bce6b9395cc74d16b9c94fd90debd9d524ffb53c6f6ae3a49b6e139671417b2

      SHA512

      bd75b564fe3c93dffdc65fe58463378f54268308ca5eaba5fc7f80458016f331a6596bfdaf63845c1d5c6c60df2a0ec2aff94d2aae7797da4f5f975f0363bd66

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe
      Filesize

      546KB

      MD5

      3e350eb5df15c06dec400a39dd1c6f29

      SHA1

      f1434cfef2c05fda919922b721ec1a17adb3194e

      SHA256

      427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

      SHA512

      b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe
      Filesize

      546KB

      MD5

      3e350eb5df15c06dec400a39dd1c6f29

      SHA1

      f1434cfef2c05fda919922b721ec1a17adb3194e

      SHA256

      427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

      SHA512

      b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe
      Filesize

      546KB

      MD5

      3e350eb5df15c06dec400a39dd1c6f29

      SHA1

      f1434cfef2c05fda919922b721ec1a17adb3194e

      SHA256

      427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

      SHA512

      b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\~szdesgk.exe
      Filesize

      546KB

      MD5

      3e350eb5df15c06dec400a39dd1c6f29

      SHA1

      f1434cfef2c05fda919922b721ec1a17adb3194e

      SHA256

      427ff43693cb3ca2812c4754f607f107a6b2d3f5a8b313addee57d89982df419

      SHA512

      b6b6cdfe2b08aa49254e48302385a3a2a8385e2228bdcffd3032757acf1a1d4abff1270f5488083cfa4480439ff161a9d0ea5f193cabc1eb1e7b1255ce262ab6

      Download Submit
    • memory/1872-209-0x00000000007F0000-0x000000000136A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/1872-186-0x00000000007F0000-0x000000000136A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/2060-182-0x0000000000FC0000-0x0000000001B3A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/2060-194-0x0000000000FC0000-0x0000000001B3A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/2060-133-0x0000000000FC0000-0x0000000001B3A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/2060-249-0x0000000000FC0000-0x0000000001B3A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/2060-257-0x0000000000FC0000-0x0000000001B3A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/2844-180-0x0000000000B20000-0x000000000169A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/2844-160-0x0000000000B20000-0x000000000169A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/5100-159-0x0000000000FC0000-0x0000000001B3A000-memory.dmp
      Filesize

      11.5MB

      Download
    • memory/5100-147-0x0000000000FC0000-0x0000000001B3A000-memory.dmp
      Filesize

      11.5MB

      Download