3d50c7ae50e4b4d100969a247d7198a867dd72dfb30e4e3ed81266c6f5d1ebd6

Analysis

max time kernel
151s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888.dll
Size

912KB
MD5

d24b38a543bfbb715b93e9059a79ada5
SHA1

af4b41a4ddd99d866360160f755a5f55fc8f35f0
SHA256

c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888
SHA512

abceb1d12fc00678b63d2439341e04bdee65952230ebd6ba674d9a9b8b6fccea04fed1e4b9f1c8f2064c944b7f5b8d71749a7b2b343923d335a8bd03b5eb3830
SSDEEP

12288:v+YE32Q8n9FgCBT4jh0rOcazvLbzTq4TYSyPKcaTuxfa:vvEwnfg04jgaXbzG4TYS8KcR

Score

7^/10

evasion persistence trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1204	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zdlpcuy = "C:\\Users\\Admin\\AppData\\Roaming\\loKyEr\\BitLockerWizardElev.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\mcLQpI\sigverif.exe	cmd.exe
File opened for modification	C:\Windows\system32\mcLQpI\sigverif.exe	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1204	Process not Found

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2860	1204	Process not Found	28
PID 1204 wrote to memory of 2860	1204	Process not Found	28
PID 1204 wrote to memory of 2860	1204	Process not Found	28
PID 1204 wrote to memory of 1584	1204	Process not Found	29
PID 1204 wrote to memory of 1584	1204	Process not Found	29
PID 1204 wrote to memory of 1584	1204	Process not Found	29
PID 1204 wrote to memory of 1968	1204	Process not Found	31
PID 1204 wrote to memory of 1968	1204	Process not Found	31
PID 1204 wrote to memory of 1968	1204	Process not Found	31
PID 1204 wrote to memory of 2172	1204	Process not Found	32
PID 1204 wrote to memory of 2172	1204	Process not Found	32
PID 1204 wrote to memory of 2172	1204	Process not Found	32
PID 1204 wrote to memory of 1684	1204	Process not Found	34
PID 1204 wrote to memory of 1684	1204	Process not Found	34
PID 1204 wrote to memory of 1684	1204	Process not Found	34
PID 1204 wrote to memory of 1548	1204	Process not Found	38
PID 1204 wrote to memory of 1548	1204	Process not Found	38
PID 1204 wrote to memory of 1548	1204	Process not Found	38
PID 1204 wrote to memory of 1420	1204	Process not Found	41
PID 1204 wrote to memory of 1420	1204	Process not Found	41
PID 1204 wrote to memory of 1420	1204	Process not Found	41
PID 1204 wrote to memory of 2256	1204	Process not Found	42
PID 1204 wrote to memory of 2256	1204	Process not Found	42
PID 1204 wrote to memory of 2256	1204	Process not Found	42
PID 1204 wrote to memory of 548	1204	Process not Found	44
PID 1204 wrote to memory of 548	1204	Process not Found	44
PID 1204 wrote to memory of 548	1204	Process not Found	44
PID 1204 wrote to memory of 1480	1204	Process not Found	46
PID 1204 wrote to memory of 1480	1204	Process not Found	46
PID 1204 wrote to memory of 1480	1204	Process not Found	46

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1716

C:\Windows\system32\BitLockerWizardElev.exe
C:\Windows\system32\BitLockerWizardElev.exe
1⤵
PID:2860

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\V3Q.cmd
1⤵
PID:1584

C:\Windows\system32\sigverif.exe
C:\Windows\system32\sigverif.exe
1⤵
PID:1968

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\jj4kz.cmd
1⤵
- Drops file in System32 directory
PID:2172

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /F /TN "Mfkxodvgd" /TR C:\Windows\system32\mcLQpI\sigverif.exe /SC minute /MO 60 /RL highest
1⤵
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Mfkxodvgd"
1⤵
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Mfkxodvgd"
1⤵
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Mfkxodvgd"
1⤵
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Mfkxodvgd"
1⤵
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Mfkxodvgd"
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\An78823.tmp

Filesize
916KB

MD5
1c0d48b8d4b34d2adc4746d7283a0573

SHA1
8889af88acfb36c44b9b9a5cbac102bdfa8abc28

SHA256
9a90a6f9577ee2deafced6a69a6be68b410346f4f96eb9cc5d39b743c4e4d4a2

SHA512
8dab10d22ca5252e5069dba9f9877854fe801e925ed8d035e8d5579dbe5e8845041f718abb54110df60a9f2c4854fb6ac3635d8e767314013477ff192b1fa147

Download Submit
C:\Users\Admin\AppData\Local\Temp\V3Q.cmd

Filesize
244B

MD5
8aa72044ee680d60847ccd3b70c70ead

SHA1
e46b97747a4222d4ac57eebeaf82e28f4a487f51

SHA256
ae97a0ed517bde6db35c0c75ccd487e5241144237da5097c3ec15488757793ac

SHA512
2e58120b4e83329914e8b65d5284706224817e9569143a0d862ddc11f8a1fef81f2177d50b2638200735853550c1d9ff47fd6fe2eaf4bb0a4f9d4b09f2a9d1a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\jj4kz.cmd

Filesize
200B

MD5
0ab62000878ff6057b7fce108bcc17c7

SHA1
c71cc30ba80b2e098f63c13f8f5e22d75954b72a

SHA256
36ae51c9232e675f1f8f140ecd9afc14731e791f34018f4130236637392b3585

SHA512
43c7fa318fc9d40ae161a40bc31dbe356d402f6a053499f7dbf6427e5c4ec1515ed67f1b87737151c9827d9bedc81c9b7e0cc18aec6e27f8f3e6ea168a9f1e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\trB971.tmp

Filesize
916KB

MD5
c9d0eff44a995485e93803bbf736fdeb

SHA1
db9b418a63c77bc701244dfd27b02eedd3505fed

SHA256
600be58ee6b2878074a26721c29a4d072486e99e55d8e6b832b5c9cb3373b02f

SHA512
7bcaa9a2fda28c6b0e4592935b32ba117d2b2d5de77e3d5dcaf89615706da4508e837eb69740b0b4e17b325e9f2b9b886a4df597a68811ff7a1b63796feab560

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Zdlpcuy.lnk

Filesize
855B

MD5
92eaa9e28568c5a8e241f3e09fdf43e3

SHA1
b30dbdc4f75c838dd292127275a4c3ee4239c966

SHA256
d4580fe0fd40ec2b643cb2369e198cb05712090f19fa234a8593e79a14653a78

SHA512
95c1733b3d8dcd50ca549b753c179e0eaa89de3a8d3e103495026377a40778ea930173e2015b92716ed267185d7ab1fcef074bba5088b80c45f6961fb185f41f

Download Submit
C:\Users\Admin\AppData\Roaming\loKyEr\BitLockerWizardElev.exe

Filesize
98KB

MD5
73f13d791e36d3486743244f16875239

SHA1
ed5ec55dbc6b3bda505f0a4c699c257c90c02020

SHA256
2483d2f0ad481005cca081a86a07be9060bc6d4769c4570f92ad96fa325be9b8

SHA512
911a7b532312d50cc5e7f6a046d46ab5b322aa17ce59a40477173ea50f000a95db45f169f4ea3574e3e00ae4234b9f8363ac79329d683c14ebee1d423e6e43af

Download Submit
\Users\Admin\AppData\Roaming\loKyEr\BitLockerWizardElev.exe

Filesize
98KB

MD5
73f13d791e36d3486743244f16875239

SHA1
ed5ec55dbc6b3bda505f0a4c699c257c90c02020

SHA256
2483d2f0ad481005cca081a86a07be9060bc6d4769c4570f92ad96fa325be9b8

SHA512
911a7b532312d50cc5e7f6a046d46ab5b322aa17ce59a40477173ea50f000a95db45f169f4ea3574e3e00ae4234b9f8363ac79329d683c14ebee1d423e6e43af

Download Submit
memory/1204-42-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-24-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-13-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-12-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-17-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-16-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-19-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-18-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-20-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-23-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-22-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-21-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-25-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-44-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-26-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-27-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-28-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-31-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-30-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-29-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-33-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-32-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-34-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-35-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-48-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-38-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-36-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-39-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-41-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-3-0x0000000077226000-0x0000000077227000-memory.dmp

Filesize
4KB

Download
memory/1204-40-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-43-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-52-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-15-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-37-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-49-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-47-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-46-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-50-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-51-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-45-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-53-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-54-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-55-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-56-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-58-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-57-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-59-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-60-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-61-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-63-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-64-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-62-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-65-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-79-0x00000000029B0000-0x00000000029B8000-memory.dmp

Filesize
32KB

Download
memory/1204-88-0x0000000077431000-0x0000000077432000-memory.dmp

Filesize
4KB

Download
memory/1204-89-0x0000000077590000-0x0000000077592000-memory.dmp

Filesize
8KB

Download
memory/1204-109-0x0000000077226000-0x0000000077227000-memory.dmp

Filesize
4KB

Download
memory/1204-14-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-6-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-7-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-9-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-11-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-10-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1204-4-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/1716-0-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download
memory/1716-1-0x000007FEF6570000-0x000007FEF6654000-memory.dmp

Filesize
912KB

Download
memory/1716-8-0x000007FEF6570000-0x000007FEF6654000-memory.dmp

Filesize
912KB

Download