Overview

overview

10

Static

static

3

2581a2a35a...a1.exe

windows7-x64

10

2581a2a35a...a1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    73s
  • max time network
    80s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2023, 19:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2581a2a35a68adc2e56befc5a7ecf24c1f3bb3278eb9da1e9ed5b5ff6acc0ea1.exe

  • Size

    2.0MB

  • MD5

    9fd909b9252da347edb2c71b1c75dbb9

  • SHA1

    cfbcf7181f4abe9a747aaad432cc32655a1d764e

  • SHA256

    2581a2a35a68adc2e56befc5a7ecf24c1f3bb3278eb9da1e9ed5b5ff6acc0ea1

  • SHA512

    b7b7f1036471d1f24836ca206b44c7cf07d2168e62fab276615a1876f894573eff38544c504ff182f206df8c483c5a30dcf7752bf94babececf6337aa122a0c6

  • SSDEEP

    12288:dTgvmzFHi0mo5aH0qMzd5807FUJV1PJQPDHvd:dTgvOHi0mGaH0qSdPFUJh4V

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • UAC bypass 3 TTPs 12 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 23 IoCs
    persistence
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 39 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2581a2a35a68adc2e56befc5a7ecf24c1f3bb3278eb9da1e9ed5b5ff6acc0ea1.exe
    "C:\Users\Admin\AppData\Local\Temp\2581a2a35a68adc2e56befc5a7ecf24c1f3bb3278eb9da1e9ed5b5ff6acc0ea1.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Adds policy Run key to start application
    • Disables RegEdit via registry modification
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3712
    • C:\Users\Admin\AppData\Local\Temp\xgpubds.exe
      "C:\Users\Admin\AppData\Local\Temp\xgpubds.exe" "-"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:1800
    • C:\Users\Admin\AppData\Local\Temp\xgpubds.exe
      "C:\Users\Admin\AppData\Local\Temp\xgpubds.exe" "-"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Modifies registry class
      • System policy modification
      PID:940
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3604

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\bcdaztayqpnqlpohfajkl.hbi
            Filesize

            280B

            MD5

            49aca8df2a04c6535207f06905f5ac40

            SHA1

            0a83e4e74ecbfc48c4549ce1d9649718c20be554

            SHA256

            29ba773e243f85ac7c2bee9faca41ec1ccb9fcc6933d4a6caeee9a9ebac7cd83

            SHA512

            36ab2f18fe3930d18bce0593245a8bfd97d877f7c1e62c36c8622ec0da6f3f2ec0a5fe1d8751ebd2afded1e1b8b8c3af90b7f06b1e4fcf0e57b3b0e8c9146769

            Download Submit

          • C:\Program Files (x86)\bcdaztayqpnqlpohfajkl.hbi
            Filesize

            280B

            MD5

            d9c4f1ffef94d4ab6b413c7462088062

            SHA1

            40a2cc98ce99b4943a207a7f825a9d3023549d78

            SHA256

            2e52bb7f521e827ec10269278cd4bbaec5623a5eb6f3708bf3a395e8dff201cf

            SHA512

            3b0c7bd070727eb042e5768cf28bfa0980768e3db79be8ee833649faafc549eb9d2a82468e3ea0100993981cfd8229716ef982486a1f22ad79334aabe94e3e23

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\xgpubds.exe
            Filesize

            3.1MB

            MD5

            7e886825e126c81f1e617183c6a441c6

            SHA1

            a9b5b76c415a2b9f20793e044e25850e725eca88

            SHA256

            ca3ff2ae7aa81dbf3eebc91f59921d985643a89489162a231557db2f14f94950

            SHA512

            ca9f5d6b47c5ad1e73b43776cbc41b6890a0413371bdebdb793f19527f65bc3212629f529e113c8a6d16c039bbe48287152306ec1269cc52797af7939a66adc6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\xgpubds.exe
            Filesize

            3.1MB

            MD5

            7e886825e126c81f1e617183c6a441c6

            SHA1

            a9b5b76c415a2b9f20793e044e25850e725eca88

            SHA256

            ca3ff2ae7aa81dbf3eebc91f59921d985643a89489162a231557db2f14f94950

            SHA512

            ca9f5d6b47c5ad1e73b43776cbc41b6890a0413371bdebdb793f19527f65bc3212629f529e113c8a6d16c039bbe48287152306ec1269cc52797af7939a66adc6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\xgpubds.exe
            Filesize

            3.1MB

            MD5

            7e886825e126c81f1e617183c6a441c6

            SHA1

            a9b5b76c415a2b9f20793e044e25850e725eca88

            SHA256

            ca3ff2ae7aa81dbf3eebc91f59921d985643a89489162a231557db2f14f94950

            SHA512

            ca9f5d6b47c5ad1e73b43776cbc41b6890a0413371bdebdb793f19527f65bc3212629f529e113c8a6d16c039bbe48287152306ec1269cc52797af7939a66adc6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\xgpubds.exe
            Filesize

            3.1MB

            MD5

            7e886825e126c81f1e617183c6a441c6

            SHA1

            a9b5b76c415a2b9f20793e044e25850e725eca88

            SHA256

            ca3ff2ae7aa81dbf3eebc91f59921d985643a89489162a231557db2f14f94950

            SHA512

            ca9f5d6b47c5ad1e73b43776cbc41b6890a0413371bdebdb793f19527f65bc3212629f529e113c8a6d16c039bbe48287152306ec1269cc52797af7939a66adc6

            Download Submit

          • C:\Users\Admin\AppData\Local\bcdaztayqpnqlpohfajkl.hbi
            Filesize

            280B

            MD5

            75418d5772030a60255e6ae6ef819eb7

            SHA1

            384c27e988f2b59812ee131a7e1bac06c57a9b1b

            SHA256

            f5f910c4dd6f74eb1f0ab4a63c99c196771a4c97cba81c2c62061f2f8688d5e5

            SHA512

            470115ed9e0bb785f4ef90477417169a81743a73d61a852448438056d70459c76652dd2b0731591f5019b8290db5233b33ceba67a4156a522d20e92c22702f04

            Download Submit

          • C:\Users\Admin\AppData\Local\wiucmrjsvfocixhluaugsakphqtdmagv.jsy
            Filesize

            4KB

            MD5

            ab23ce4b14674576019e52a14dbc8692

            SHA1

            13e55a73b50a76d39a64a989d289687accc1ddf1

            SHA256

            df92e5a08496e7e94faafdaa2502745309769987f204da2e4ca2944361409b7e

            SHA512

            1c4bf29e87c4958c7f033ca088878f6e900448ae339e04c9ae8ac4c17f22fd70564aedb6e65682065582e8bf6c9d3ae7efd65568fbfb783d450308bca16576cc

            Download Submit