Overview

overview

10

Static

static

5

3dd8f24394...50.exe

windows7-x64

10

3dd8f24394...50.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 21:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3dd8f2439496f3d717b331fddedaef50.exe

  • Size

    512KB

  • MD5

    3dd8f2439496f3d717b331fddedaef50

  • SHA1

    9709caf99b2792ff93ba7d91b21fcd4471e67656

  • SHA256

    26677383270ea811511416f35b450fd53c0941d30fea1428e1d33a9faea0d356

  • SHA512

    1ba2564f470d8b240337a37ce08915a366ba008c2592ec31163dbdd38cfcfa9e77e96bc75a800fee0ad06f6e13e4b95c40964b0182130684e09e7c56f96fc1d4

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3dd8f2439496f3d717b331fddedaef50.exe
    "C:\Users\Admin\AppData\Local\Temp\3dd8f2439496f3d717b331fddedaef50.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Windows\SysWOW64\vrloapaaky.exe
      vrloapaaky.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\SysWOW64\trrgjjwv.exe
        C:\Windows\system32\trrgjjwv.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2788
    • C:\Windows\SysWOW64\hyibnnbdgenfmic.exe
      hyibnnbdgenfmic.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2268
    • C:\Windows\SysWOW64\trrgjjwv.exe
      trrgjjwv.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2752
    • C:\Windows\SysWOW64\tdqdbtsfmfcyg.exe
      tdqdbtsfmfcyg.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2756
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2028

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      157bbdf179707a35c808248cccead433

      SHA1

      734562164fb88f87f24b91486bb725803d6cca0d

      SHA256

      c301b2d75599351ebb266649f1686b2495d8d3dcee484005080fe36b0b3b0948

      SHA512

      5b6cf09a674734d5dad7d8e3307a7d2ee0ce3745c78aa61c20545dad2b981526a8f9fca7a7e8b0ada633933ea8c312e7c8a9def78c074808c2b5979aec120093

      Download Submit

    • C:\Users\Admin\Documents\StopImport.doc.exe
      Filesize

      512KB

      MD5

      45f9e5e59644cd6fbec92e6b3c3f7e9b

      SHA1

      a218ac60d17c263620e7b70e6bcbe1aafa94698f

      SHA256

      1f3900b6256b72f10458d49a01fa951e2e4e8cf033425e21cad323995a08af3d

      SHA512

      ad3963cf8403a657816865fd008d3d6e8f3517a4a0333b563be788b2446383be180692715378b1cec20f841602d17f7081f151ed3adecf1cf354003b1d87ac3b

      Download Submit

    • C:\Windows\SysWOW64\hyibnnbdgenfmic.exe
      Filesize

      512KB

      MD5

      940900f3ef1aa308c7c99be6819ea915

      SHA1

      5d5d1a307f7ef7197f7d27b688f7904c7aa0423b

      SHA256

      c0f53b7c247c297070fbc65ca7d8ad0fed2d0c05f8c5ca998b0a9de6e7d40d69

      SHA512

      56fdc42f583892646daf7b63852eb3ccb308e5f163fdef818d5efcc0cf887731f9bd95f0691c449e373c31187be8b6a411293551383d7e314d9ddf9f7f3361b6

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\tdqdbtsfmfcyg.exe
      Filesize

      512KB

      MD5

      98a86b01bfd2f7e2ac872ade1c1df577

      SHA1

      accca8a3eb7ac2d785376a4a4885dcf5556b1d68

      SHA256

      57bcc2765be1bb8276b8c76a1852b263c207704bf004f83c4381b2739489c7e1

      SHA512

      1868b95a75d28443fe2f75e4560bb2d3f71f1677ee8fb07e2245a5b748b7aaf9e49242f339bbddde8c137be2529b997eafcb7f64049ef53a79f37049c1c2189d

      Download Submit

    • \Windows\SysWOW64\trrgjjwv.exe
      Filesize

      512KB

      MD5

      0439243fcbb6375dae88640264824b85

      SHA1

      8e989ab2aca26a134b2589b7221bb1bd2da6a61b

      SHA256

      2a7a96861c8f8d41f198dc3ba7ba262ee0098ac4f4643ec354b106093d85fe26

      SHA512

      a5c523e296cbeb0f61a4b582b74be6edab5186f6acf91772ca4be728eb748f3403d31c5dc2048eb615003b4af5916deb9d6a413dc11f7455885dc31256dd0d48

      Download Submit

    • \Windows\SysWOW64\vrloapaaky.exe
      Filesize

      512KB

      MD5

      0b36f72dc4b3b0a8831b619af774801b

      SHA1

      291f97d2fbd532e1c3aff2938f642cdd6b47a401

      SHA256

      0714a18f5aefa02ad66adb21c67b110181f2c6607fd20bb71c5deb00dbe97662

      SHA512

      f43402db118e516ffde91f8e4fe14a9c28f6b574ca183d187c15956b8d0a9010914a3dec6bfaaf11a175984b84099bfc351cbff7b18c190cd9e005804c8bc013

      Download Submit

    • memory/2056-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2912-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2912-47-0x00000000713CD000-0x00000000713D8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2912-45-0x000000002FD21000-0x000000002FD22000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2912-80-0x00000000713CD000-0x00000000713D8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2912-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download