Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24/12/2023, 14:41
General
-
Target
01c7d88acd3c1d39384d04c2b1066b1a.exe
-
Size
512KB
-
MD5
01c7d88acd3c1d39384d04c2b1066b1a
-
SHA1
afb440656640e6dc77a3171aa7ec8cd71d87cc25
-
SHA256
b24639c9e5eda15b98c47d33d5432b558a8d0af5cb2e3fd8c288763a61b4c9de
-
SHA512
a6772660f80f98e04cef0f7d7ce768a6f66641500b6d81a020042b46ae2faeb1654ddde11552684333cd021978835e7906c72a65e23468fca7bd8e8b2a92e6ef
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01c7d88acd3c1d39384d04c2b1066b1a.exe"C:\Users\Admin\AppData\Local\Temp\01c7d88acd3c1d39384d04c2b1066b1a.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\leilnood.exeleilnood.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\agexopusjlwoshg.exeagexopusjlwoshg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\mpjhpmzxroqxd.exempjhpmzxroqxd.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\myxsvekaac.exemyxsvekaac.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\leilnood.exeC:\Windows\system32\leilnood.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD558cc44755a539da86b03ad171e430317
SHA127cc875d0d17a4e1e4ad63a9cb18f8ae7359f508
SHA2567134976f693a32f17937f493f257e7006825e99847ffd37118b02df8ea386973
SHA5129f4f001b938e316a634f64861dafedb87eca3ef61f5872cebedb5ad6685473e87c71df37ba8638e83e078093cf794bc9e0692e4563edb8609ef1914692efea95
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD599d6302dbdd7b207e77a490593d34e46
SHA1832730cc3205f50e8c76381c28c5b108e79458e2
SHA256efe0546053468618e084104421a8ca5cf9953597ceeab10723a03b7884e46b80
SHA5121b57c98bda48363404c620b9c9919b30774834a40b0d4d4ef8f20a7647238578858cbbfda7ca3f6d68152ec1c4ad27273b4333ab3419a2a2afa7ee9d810f243e
-
Filesize
3KB
MD591bfd232fdeba21cb33d37fd49734422
SHA1605ab366b67dea844ac6235bf96e7b11a227c78f
SHA25649e7ab3b3e397772e25419ee2b6f2d79d7e1716c425f4f5fa35bd594ffb9f98d
SHA512d4bce19ea33b92b3b583ce0613e4304f9c309311f9553b9fed3657eed3ec01b22bef500ef7f8a76c2956a28c2470043562b4ac474b82b2d381d2ed2f2f453ac4
-
Filesize
122KB
MD5a5c668f73fb8847fd770a22f1b6eeb8c
SHA1c2e66458d3d19925cd30363444029168e86bda57
SHA256ecc2bf6d449c6dd836424ced29f905e8373bade3eb891667a1be955992eaeaf7
SHA51231311ae752c7ddb2e7132f41b81feb43f3827624e2ffa66735e1654e09cc343ca68308d92f80a5f148007dec135a9edf879b6ae89fb6d035f7be0bef24edb754
-
Filesize
82KB
MD5de6a5a3a23c5303ecd4af49ff33515e7
SHA148098b8d73e91428def021503f4d87b7d3042f74
SHA25609887d916759aba0b8151d165a1bd1a159a520d226ecce354b15d434cb18f109
SHA5121d15bf5939a11fab416c30598eacacbdba461bdf8b9f9a59d67a07d42b4c19582f4fc2e4eb421dbae37c1b10dff47969dee9009d48eb41eb21e3df9141bfc405
-
Filesize
24KB
MD56b50861facd24be6adfa366d73936c4b
SHA13476a77209b04104c81d8ab82812863a27bbdbfd
SHA25685650b58db91ba38ecfe1eba2c4476b708b72e4e3069624cdb458b58cb5e91e0
SHA512866c32b195806d3612b4224940834a4998bd0fc7bbbdfbc55deb93781811d41c800bf474c7b40d50449705cee3e3c408f88accce78d82a1827b72f68fddea05a
-
Filesize
99KB
MD5587e39711e64c77d192dc2e041195601
SHA10d89c7b0b6dbd8536afa1bd3b85cebdbeabcf59f
SHA256747963e380030dff904d146e1a918b29ff90bcb7b7a2f336bfd8eec0c2da1f46
SHA512b6de5ed3f0018a5739ea80f3cccdea99282fd4db099ab403d871117d5f222ec3c3ef408e50fed043f966c0f0b21ae7cb1002ddb57fedaa6fa48e88363975398a
-
Filesize
157KB
MD5e8b0e8baaf2ef7733d8b7ee520d90cc0
SHA1f65cfccbeda97d8b435a6cc729931b2dce4f2f4c
SHA2561eecccf5851a033393ff62ac4d18a8880e4b1069ca613487fe57722737834f76
SHA512989b46fbb02c7cb881539f85e0748a12bc1238c4af6a1c880cc95871a829e2767b985976b58b447089bbd9d2de0fca14192972419f9cfe328d687ddc88e1c41f
-
Filesize
26KB
MD59cc8bf42cd6e82f01bdd611d3f1df11e
SHA10ac080ee00dc0518ca85fb1bd1e0594567c29a0c
SHA256aabc41b3b003e38ef28f955ffcc2243642c2b7cee911fe913a94395d6666135e
SHA5126482c9e150289cead3690beb90e8fdb0a9d525c5b5e294524a3bd178efec19a1dbe3b76712919524a2a25f54244d26e52835679692781e09f3aa2bf65139120e
-
Filesize
57KB
MD53a81bb7f89fff51fd80d1e9e1e60471f
SHA17c04e73b47855108f7cb0f1f8e76b71078d74158
SHA2567afee2b09ec479879bca80da134ceff2df40ad8eff99ed5b1461e6b64e3c474e
SHA512d8500626b99b14b8e441c88b9a8431db9188b5dea17610b1d5ff35a199195026f6c9961281e7c3a4babe8c88b1a949a03a42c6872e2eb0ec1761f65095f777cc
-
Filesize
90KB
MD5e5393fa836263fb4646a058e7e2b52e3
SHA1861e0f2e56efc77172edc475c5845dff31093022
SHA25675cec1552206fe216060d70d0635fbca3b8aebb7d81bfc5c2f0d9db8c8b376cc
SHA512413ac6ecaf7f846877c0d6085a3856477985128d5121276af12aa413fb3ad0f5ef921a8d71bbc84d9ee32100dbc0a126438d492efb3870a624f13c65bd597ca3
-
Filesize
49KB
MD52d3e20b2a2fd862d22e115922011421d
SHA145c3b5719d5d10dfb96fe63389cdb9d311c6efd0
SHA2565da68429410aeac29cd74299af8ea567abd5f6040cb7c07b15b75651c50c82a3
SHA5120e33d9bbaa6a4f1026ee11f741b2ba5d8d1c09963836917d0cc5d18e3a228656175d395670b4b6d88fa756a8ef0987ab24ea297f90396d3f0076cbcbadddf13e
-
Filesize
1KB
MD5ec89629d437c17787acc7061c89e753c
SHA1c65089b32eba1cf75d3546335718073460c971f9
SHA25687b17909878537f2c3d3bc046f54b9eb382e312fa75d2b177457a978dcc7d83c
SHA51265f02cc30b64e2c33d7287c135bc0bb20abe1e35c7176a03e47403db3e21da28f7e7ec7a13ef748aeb76ac06e5e159a9b4e62196692c3411459a4ae235a1bec9
-
Filesize
151KB
MD57e0523346399a521d3dbd39f5a9cf453
SHA14f6556d9d574e15359e1dfcd25f580018f6e3f01
SHA256a9a3f617a0a52df90ac10f33f85bf789f2b276e5cd55be002ec076aefe07da53
SHA51229dc6fc59f9c4462d204b518e6cb485e0fc9c1dc5e8d471c317c31913a0778846ac2dafd9638f88f1c564d9e1ff3963af46f3d31d8a6270a4f95f61dbe197e81
-
Filesize
30KB
MD59c44ef86a9f3e566ce1ad64265878ac1
SHA1aae724dca8a6416fb5d344298fd72942f7425459
SHA25622b30edc67c8f53d4ac5fbbad56e1edf2ed3ef67eceef59a8613511230091042
SHA512822e9337365ee89760d1802246819fd46e8e3734488aba9ea8fcde1e5fd16305c5bc7af148f45b59492bde629993b976005604d06fa4504ba2565e4042b4ef21
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
133KB
MD5ac02cb0681c68e60d1f1b541d476cabf
SHA16ba7f6fa2944161a8e317af51480b64df29e8ef5
SHA25611b1f2afc24cc44070c5fae1eca500abf45445b291ade8c73927da050f4e487f
SHA5128d604ce12ab4a8ec768f6d99a205f46af3c3e158447b9d662e62ed83ea067f972e118a6d81069e1d3d923b2cc449e1f70ce0d8b0fc4497ba1b29a2593b1f1b2f
-
Filesize
43KB
MD585c396da33d07ca41cc32d67ac3aba7b
SHA15f7a16ea8ff75245eae774b41909a70c3e9cfaad
SHA2567cce31fa9135eac6fc56db0e4bbf7740417ccc0d948c15d802283b2bf2d7600e
SHA5124d431b8bb138b3d7b868a833807a5dbc638c63f0373863dee24125407c3693fc5764c126abea3d2c6c92477192ecd8650adcbca04732aef39fb82b4d083ee26f
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
600KB