Overview
overview
10Static
static
7YoWhatsApp...26.apk
android-9-x86
10YoWhatsApp...26.apk
android-11-x64
10clockDarkTheme.xml
windows7-x64
1clockDarkTheme.xml
windows10-2004-x64
3clockLightTheme.xml
windows7-x64
1clockLightTheme.xml
windows10-2004-x64
3ic_content...on.xml
windows7-x64
1ic_content...on.xml
windows10-2004-x64
3ic_content...ck.xml
windows7-x64
1ic_content...ck.xml
windows10-2004-x64
3ic_content...ck.xml
windows7-x64
1ic_content...ck.xml
windows10-2004-x64
3ic_content...ld.xml
windows7-x64
1ic_content...ld.xml
windows10-2004-x64
3l3ce7c8df_a32.so
debian-9-armhf
1l3ce7c8df_a64.so
ubuntu-18.04-amd64
l3ce7c8df_a64.so
debian-9-armhf
l3ce7c8df_a64.so
debian-9-mips
l3ce7c8df_a64.so
debian-9-mipsel
l3ce7c8df_x64.so
ubuntu-18.04-amd64
1l3ce7c8df_x86.so
ubuntu-18.04-amd64
1stella_e2e.xml
windows7-x64
1stella_e2e.xml
windows10-2004-x64
3stella_wa.xml
windows7-x64
1stella_wa.xml
windows10-2004-x64
3strings_ca.spk.ps1
windows7-x64
1strings_ca.spk.ps1
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
30-08-2023 04:44
Static task
static1
Behavioral task
behavioral1
Sample
YoWhatsApp-08212028-626.apk
Resource
android-x86-arm-20230824-en
Behavioral task
behavioral2
Sample
YoWhatsApp-08212028-626.apk
Resource
android-x64-arm64-20230824-en
Behavioral task
behavioral3
Sample
clockDarkTheme.xml
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
clockDarkTheme.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
clockLightTheme.xml
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
clockLightTheme.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
ic_content_sticker_location.xml
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
ic_content_sticker_location.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
ic_content_sticker_location_60_percent_black.xml
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
ic_content_sticker_location_60_percent_black.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
ic_content_sticker_location_black.xml
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
ic_content_sticker_location_black.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
ic_content_sticker_location_emerald.xml
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
ic_content_sticker_location_emerald.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
l3ce7c8df_a32.so
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral16
Sample
l3ce7c8df_a64.so
Resource
ubuntu1804-amd64-20230621-en
Behavioral task
behavioral17
Sample
l3ce7c8df_a64.so
Resource
debian9-armhf-20221125-en
Behavioral task
behavioral18
Sample
l3ce7c8df_a64.so
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral19
Sample
l3ce7c8df_a64.so
Resource
debian9-mipsel-20221111-en
Behavioral task
behavioral20
Sample
l3ce7c8df_x64.so
Resource
ubuntu1804-amd64-20230621-en
Behavioral task
behavioral21
Sample
l3ce7c8df_x86.so
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral22
Sample
stella_e2e.xml
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
stella_e2e.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
stella_wa.xml
Resource
win7-20230824-en
Behavioral task
behavioral25
Sample
stella_wa.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
strings_ca.spk.ps1
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
strings_ca.spk.ps1
Resource
win10v2004-20230703-en
General
-
Target
clockDarkTheme.xml
-
Size
1KB
-
MD5
663e33bfbbb0d14830694114d49c457d
-
SHA1
3231baf54a3c1f336f1b11d9a7011bc5502a9d4a
-
SHA256
43b0cd84c7344f57b2656d66d5bf215a4f1d1713a8117e0ecf92226b8ce1a200
-
SHA512
c116ffaf6c1f8ad9bd6a1d85de318c9ca2c3b6d4931a1aa165dc7ef7351c80fbddc7ca1371c81dee35b3e12720fee2d3146d7a510b54026c3aba9202dee5f1b8
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc Process Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{067B6EC1-46F0-11EE-B530-E23FD76D3CC4} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb0000000002000000000010660000000100002000000031da6d2dc3a5ba7e79a11ddab8969623ccb74cc563f8ffde44dbafe5d1863aa9000000000e8000000002000020000000a4e5fdffe8ce0d1b08b49cfe18d53d0ad1cb04b406d315fac2eacb857519e75120000000c230bde49929f68b744e1d1992528eb72019914baa0a12a8ec6a62777e0a1f5f40000000dd3c91ca52c2dcfb8ae78ff18a4b610bc9b84e0d1feba453f69075f96c39d5f47abbc4307574aac0d57308865e04cf21b87a9cf5927b92fdf931e5eed2d65713 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d04646dbfcdad901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399532610" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb00000000020000000000106600000001000020000000b23504ca72ede8cf93f51a5f355caef518c89bbe98dc8c80593f5a899de147e7000000000e80000000020000200000008309a27ca229314c3d702682ba100f70a4b643e3f26c1a2818f6c8f65f18d58f900000005902b60f709f644f87e727ce5a2696cd7ce7dff579c9d9bc9b25e155823aade494b27fed130860fe31de9bc54453a247057ffed73a40e852008dc7247863fbff6592144700c7baed8e41e1330ecee3fea4b8ba136bfff460bda1583c40e37988788a04cf2dfa3427989ccbd3576f875e14c298a2749eee6ed913e5d986a61d3291aefa8c8ac0e6796e3e3991c4b5facb400000008a2bf416a2a13341679a040eb5cddf874eab7d70d903da7003249f0c7d4755e636f3abb48a00d8f695b4aeee3dd7564b2e9e7eeaef944e55e109c46ab4c8bd67 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid Process 3040 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid Process 3040 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid Process 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid Process procid_target PID 2444 wrote to memory of 2972 2444 MSOXMLED.EXE 28 PID 2444 wrote to memory of 2972 2444 MSOXMLED.EXE 28 PID 2444 wrote to memory of 2972 2444 MSOXMLED.EXE 28 PID 2444 wrote to memory of 2972 2444 MSOXMLED.EXE 28 PID 2972 wrote to memory of 3040 2972 iexplore.exe 29 PID 2972 wrote to memory of 3040 2972 iexplore.exe 29 PID 2972 wrote to memory of 3040 2972 iexplore.exe 29 PID 2972 wrote to memory of 3040 2972 iexplore.exe 29 PID 3040 wrote to memory of 3048 3040 IEXPLORE.EXE 30 PID 3040 wrote to memory of 3048 3040 IEXPLORE.EXE 30 PID 3040 wrote to memory of 3048 3040 IEXPLORE.EXE 30 PID 3040 wrote to memory of 3048 3040 IEXPLORE.EXE 30
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\clockDarkTheme.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf