Overview
overview
10Static
static
10Builder.exe
windows7-x64
1Builder.exe
windows10-2004-x64
1Builder.exe
windows7-x64
1Builder.exe
windows10-2004-x64
1Mono.Cecil.Mdb.dll
windows7-x64
1Mono.Cecil.Mdb.dll
windows10-2004-x64
1Mono.Cecil.Pdb.dll
windows7-x64
1Mono.Cecil.Pdb.dll
windows10-2004-x64
1Mono.Cecil.Rocks.dll
windows7-x64
1Mono.Cecil.Rocks.dll
windows10-2004-x64
1Mono.Cecil.dll
windows7-x64
1Mono.Cecil.dll
windows10-2004-x64
1SixLabors....rp.dll
windows7-x64
1SixLabors....rp.dll
windows10-2004-x64
1Spectre.Co...rp.dll
windows7-x64
1Spectre.Co...rp.dll
windows10-2004-x64
1Spectre.Console.dll
windows7-x64
1Spectre.Console.dll
windows10-2004-x64
1Stub/stub.exe
windows7-x64
1Stub/stub.exe
windows10-2004-x64
10Analysis
-
max time kernel
105s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
05-07-2023 13:14
Behavioral task
behavioral1
Sample
Builder.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
Builder.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral3
Sample
Builder.exe
Resource
win7-20230703-en
Behavioral task
behavioral4
Sample
Builder.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Mono.Cecil.Mdb.dll
Resource
win7-20230703-en
Behavioral task
behavioral6
Sample
Mono.Cecil.Mdb.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Mono.Cecil.Pdb.dll
Resource
win7-20230703-en
Behavioral task
behavioral8
Sample
Mono.Cecil.Pdb.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Mono.Cecil.Rocks.dll
Resource
win7-20230703-en
Behavioral task
behavioral10
Sample
Mono.Cecil.Rocks.dll
Resource
win10v2004-20230621-en
Behavioral task
behavioral11
Sample
Mono.Cecil.dll
Resource
win7-20230703-en
Behavioral task
behavioral12
Sample
Mono.Cecil.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
SixLabors.ImageSharp.dll
Resource
win7-20230703-en
Behavioral task
behavioral14
Sample
SixLabors.ImageSharp.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
Spectre.Console.ImageSharp.dll
Resource
win7-20230621-en
Behavioral task
behavioral16
Sample
Spectre.Console.ImageSharp.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Spectre.Console.dll
Resource
win7-20230703-en
Behavioral task
behavioral18
Sample
Spectre.Console.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
Stub/stub.exe
Resource
win7-20230703-en
Behavioral task
behavioral20
Sample
Stub/stub.exe
Resource
win10v2004-20230703-en
General
-
Target
Stub/stub.exe
-
Size
1.6MB
-
MD5
303df0ff45fc487db83f9a14a7eb3594
-
SHA1
e36f528cefba775bf21f04cc208e90b815df8234
-
SHA256
35b48e9472a04ef28d51e5af06dafc8d8573d22bd4159cfc5007b7321a0aa337
-
SHA512
1ebaec29abe8bf659255a3e78893921a5916f8ab8c8d9f607da27e6284cc885c0951bcda7bcbc6cfb47e650a3f1f96c575f0e38881474a227c02ce84821e11a2
-
SSDEEP
24576:Di2Q9NXw2/wPOjdGxY2rqkqjVnlqud+/2P+A+ZecdyFoBkkAnexMrdgLs:mTq24GjdGSiqkqXfd+/9AqYanieKd
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ef6bcf42afd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3CDFDA1-1B35-11EE-B867-62AE83E716DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cacdb9c8f7e7d1478a5f6d5a6cb4c29000000000020000000000106600000001000020000000d6f8f5ced438c4b825f17f0c204a85321559ce2292f14830cff7d627c47d6c10000000000e80000000020000200000009e302704bed63d720d915766d730397340b8a4246e8e52d4af6d91635dd6f828200000001e3b7c1432adcc0e4b86cb701c43f391aed1e4fe4d2be3198fd7a4d6744a03e7400000008c02abb0acdaa421c692af338516a86627237b6b77f193d47684b7d47e36236fc68c29bc8fe8a248607f40439bb40c95c6358242be8f2ba60c7b6ef278b81bfb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cacdb9c8f7e7d1478a5f6d5a6cb4c29000000000020000000000106600000001000020000000cee5e3eaa728710d07aaceeb372ca33208b71d1bbcb21d024e39e505b0364170000000000e8000000002000020000000a5309e59dea9c629757717029ffdc05a7bebca3400e593565a915df3a4d9f329900000006dad6eb784325c2f169cdb16fd04688ed791945413cc547f775ef9295ce8871567d3245adc8312ec3439e70c8beb1688eb4f2bc476526a51bc33d65b905f92cefec142d9ad4e2d18906a24b3b7aec2a78e1fbf1c5eb8ea257c334e26e51de58eece4729fcef34d747a65d27b686aa378dca4aea3f139b7ac3a9ab98935a65739d6303a19e70e48526eaa8c5d55ed3b0240000000b50eeedc0bca0963d5ed324d5c47f8659ce899c2154c1b28a0c8d6120973271adcf0566df11badf5471e1cf0048c7827f306c1e842f17b250acaf5b18d5787f1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395327878" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2416 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2416 iexplore.exe 2416 iexplore.exe 2864 IEXPLORE.EXE 2864 IEXPLORE.EXE 2864 IEXPLORE.EXE 2864 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
stub.exeiexplore.exedescription pid process target process PID 2388 wrote to memory of 2416 2388 stub.exe iexplore.exe PID 2388 wrote to memory of 2416 2388 stub.exe iexplore.exe PID 2388 wrote to memory of 2416 2388 stub.exe iexplore.exe PID 2388 wrote to memory of 2416 2388 stub.exe iexplore.exe PID 2416 wrote to memory of 2864 2416 iexplore.exe IEXPLORE.EXE PID 2416 wrote to memory of 2864 2416 iexplore.exe IEXPLORE.EXE PID 2416 wrote to memory of 2864 2416 iexplore.exe IEXPLORE.EXE PID 2416 wrote to memory of 2864 2416 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub\stub.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=stub.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2864
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552cc19e9d121d2d1f1f5f32454bf228a
SHA1352c6aa61483eaf6d2eb02d4e5e453cf68e7fcf9
SHA256a02c2a4c1fd797dfd6f061651fbb9c0e853129ef65f375b7f9071fdb59913588
SHA5124e3582596f43a245059c8b9e2bbbe6c553480eb842fb63031976a28c67807ef3bd081febdf7d7d4e7f72e8cec6b877a2bf76b250e1d780d4bd5713cfdeb76f84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530c44b1a6db74b044061dd4f611419cc
SHA1391fba81b50961319978fc7ce821a27b719eeb68
SHA2567ddcb22352fd4cbb9b1597c6d43e3e82f04ffc87cbfcd8901d9b8ff67d7b86ee
SHA5122afc0dced43273a07f429396936dfcd84832007e892d882ecc1a1eb5c4ec232b8b6885dd279766ad6a5e1f1af06f26e840226c35d14039e11a12ec607cda0a0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581227b0bbb81a33db637ce7642f00d92
SHA1ef92e7cc6f9fdc757f28a6cacdece87c0ae6c7bf
SHA256058138b68cd1594bec9c0a3d496754e2a0d3ae912a4c4f3cdb0536edc0ae2ab3
SHA512670c4f2554bfd1831533425c7d88a1b5bb2dd4b3cae7bc973126faf15df602b61ce2a5ebb6ecb62f19e69335a53adbbee4f543698f5ab332d27f7d509ba2f836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ded198cc91410f3bd8d5726a2a4604e2
SHA142b0306705a8ef1474ee4cd9f5fd610635104626
SHA2562a8a78e4e68f5a92551dfcb417da604bda75b26820fb7b76a6e6fb17507c84b8
SHA512974bdfbdd51cea24de7229946c9bfae806e7ea53bef8d605c4fcbdfc0a498873ef9bde244f84816ddf632e81d2460ffc723d3baabbf710ef7cfdb308b1e0a03e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58965b12e18244e33eb332cfae11eb284
SHA145c5a8e8c67f2ba88094ec6234e527359e2eb749
SHA2564e7c4ea7eb4b995bd5e39d90030ca77aab2dfa24f76883d0ee516dd030c3effd
SHA512c580e158b522bcf0413449437a4e520642a0793b6b29b0a8dd33c67d97f949240b0ed06945c97fdbe3dfc2decee1cb37780684a54a10d2971208aac60e170a27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f939e8e7f6e282f01cf287a25f7d4140
SHA1757ab9f2492eea386b7af62fc4977a2c59a075c6
SHA256f1977c823a8c84d40607e6319bf76ed748785c43857911c77982a74043c5262e
SHA512e6965a0c4c1119afd20d65f7297da671e939940ba376875f85e0ef3d87b1163c74b4b3f058d82c8079baebaf3b08a06e98a079d07514aa8fdfcf1ce0e28b6496
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51911b2958dfb58c94ca16e04f58473f5
SHA1cefcbf06610dd3e80bf04dda43b965fb933866e7
SHA256825cd5ba68a02aec732031f4416b5faf903e1255296864490113ecb7484d3a89
SHA512f15d58afae89b9e9ee3810de11f5b4f033c4beba5b9baf622e3ce32b107080b3cf07d7b0ef9941fb674143d4ff4b9d8332094e5cf58848c7d1c7fca6b0c5fcb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d48bbb32a7c6c4652208779002eca1be
SHA14b2ae3b0d4e53787c1cf5f1ee0bec7ffa9915ded
SHA256b914deb1751182303498f1eadaf3fb7d80ca0bed0d0b38a56bbb79340c27d4da
SHA5126a8e4a5c02d9c429c665352a8ae1e0f229280715b78811c71c744da65e79c7f159f8c7a6be1243f36d4512904f1d5d5b31b368f0ce02fb9470c67246f66c2196
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b0f13539d8984932a51d8ebee6f7d8b
SHA1f80562ecdd684110074c8768d8b795c658058737
SHA2566b3499e5b5cd4cd1fd3fcab10135e3a9cae8b1b7439d1271584082dd8275fadc
SHA512a6759f90a1a76473f9a24a12af378d51c40a17b358d031939e461c7c476c9f50976205fac33f0afa8d892b15f44886930be6a605f5791515dad230a8e2d0da08
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V6CQZ6HZ\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
608B
MD541ec6b9c6aeb32a4f58cd19370faba6f
SHA18ad54a971d3aa9deff6b8c1777d1f102144101e4
SHA25697a0d405bb3d15baf60630a41d4c937561b63daf7468554132ea3a26fe0ec789
SHA512b1dbd7f292daa7391df08810c58cee76c98ad6ffa3e551a4d231552efbd3518a2c71568764df031d1831b258bd630d12fdb376cba8f8252e672a9e7089481236