Analysis

  • max time kernel
    160s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 22:32

General

  • Target

    4067195daa7c6392d705460325253350.exe

  • Size

    512KB

  • MD5

    4067195daa7c6392d705460325253350

  • SHA1

    dd4bd00ea69c32ce1a88020b0a01add80fcc9456

  • SHA256

    678d26894cc17d30e4f3b4c168065500cb7d86f1d69ac964fc3418683a1eaf5a

  • SHA512

    b2b0d8a3b0ee33c0352eafbe874e0ce61b7829586405374d50d62a5389acac4741ed1b733bc050609bd6a8d7bd516f0e107c376cab463a369c7ac62fc6262b25

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4067195daa7c6392d705460325253350.exe
    "C:\Users\Admin\AppData\Local\Temp\4067195daa7c6392d705460325253350.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\SysWOW64\kmtqsctudl.exe
      kmtqsctudl.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3148
      • C:\Windows\SysWOW64\mwmexzwr.exe
        C:\Windows\system32\mwmexzwr.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3056
    • C:\Windows\SysWOW64\kaurmdgyqmrtqkn.exe
      kaurmdgyqmrtqkn.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1860
    • C:\Windows\SysWOW64\moecumkvdvqqq.exe
      moecumkvdvqqq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2868
    • C:\Windows\SysWOW64\mwmexzwr.exe
      mwmexzwr.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4408
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    12b138a5a40ffb88d1850866bf2959cd

    SHA1

    57001ba2de61329118440de3e9f8a81074cb28a2

    SHA256

    9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf

    SHA512

    9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    97bab49048f6e259a2d10b0c6c6052f4

    SHA1

    4a5b6ad23539634267843220fc8a6fe4b9e40256

    SHA256

    00f1b030b83e53e565e4a50d7933eef897e028f0a24004c4bdff5dc6608269b9

    SHA512

    f8ad1c07c5769ed357c7f8ce9c6f66f97afedd69d323fd5d2b6cffee969691421d7a94e62ab7962d54d478b9088f24f75bf82966b7f0435844dbed5db03a49d1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    4e14eba621be618b045391cb1abf4ff3

    SHA1

    0b07aa9758ac229120fe7dfd63286f8fa77c991c

    SHA256

    6d5e8467df04cec1cf936b67cbc122729e55dc0db10d7facac52be0f810d9228

    SHA512

    6d61fd30cd1d52f4de8819cb9a829ec9611c0b40fa5ba7ea172b6b166464519670dc09457b9169dfb6ebbda0a0dafd05ee071b7b513ae941f47dbc3601d30baa

  • C:\Users\Admin\Documents\EnableDisconnect.doc.exe

    Filesize

    512KB

    MD5

    d03fdef1ce0dd6ef50a1ad954c0e1937

    SHA1

    8aa329abecfcfca42052be9577509f055f62ce9b

    SHA256

    73efbb92a3493fc5df54ccf2b560fa3e552b9e43a0046175cd0650ab1e3bd0d2

    SHA512

    0778b59983b854196ed08c52e831bced4e82a0390df4ac9c5e9c93d83a6b4721e43d4be5cf37e1698e23ea000b2d8ac794fc90a81ea5e71730181f3535e18fc3

  • C:\Windows\SysWOW64\kaurmdgyqmrtqkn.exe

    Filesize

    512KB

    MD5

    2501f446d60171ddc040bd6e840d482b

    SHA1

    e000dddc23c4d9871a527c3f2c405cf390ea21b7

    SHA256

    b02340a20a970690a7643286c5aa8ff5ce149cf4d6dc4901370e7b19d2b2e943

    SHA512

    c27e6d2bb0c57cdd3ef73b855e7f6585568087fe373ea50f745e0aff821c24b176af0661e3ae250142a3eb02f3c46f0956b89899ca405b7a4cd1da5dbcafc400

  • C:\Windows\SysWOW64\kmtqsctudl.exe

    Filesize

    512KB

    MD5

    baa5db3cae684f72e4e67d6eaa8f78f2

    SHA1

    4d5a39511d7e619c7aca41d102a83bd9f00474c1

    SHA256

    3b07b85fa586bc1c0359d6b89c9cd8065a26482bace25cd7834fe90b1227b062

    SHA512

    0404739051e66d031a2a5210fbc68147c46f4c6ee8909fe9bc970f1320cc37f6d958427b0660136af086555c391d07038521272b2d51392522d26e5fc3d29145

  • C:\Windows\SysWOW64\moecumkvdvqqq.exe

    Filesize

    512KB

    MD5

    3300ab909530e1a50a8c95162f70dff0

    SHA1

    4b8ef04c077a0f46793091fe11567e74e5a23013

    SHA256

    e254f759a6faf60fc8e2c69e9917236fdd1bda0dbca56384d41c8faf50689fe3

    SHA512

    47a547d5315f8f8d54b1572cc46971b53e77e6ae058d7197d13545802216ff6650755801af6e972d7e40cc1bd09b9107c246317f71a3eeca3bc8791dd38f24af

  • C:\Windows\SysWOW64\mwmexzwr.exe

    Filesize

    512KB

    MD5

    57fdb3a44c895681ed9a459462454784

    SHA1

    2ed9a2ef54276ef78188772948d8add6edc84b74

    SHA256

    5ebd0de1db7d1054334e10ab757de8cba048415365d1a3aca177536fefd92cfb

    SHA512

    2220eec35a6f1e8e189d51bde6eede56fd525c22bf14e448072eb296c24e5a8c799ef19265954ccb0adbdd05f0d2763643ba576daa8ca3bd44c4716805ae4c65

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • memory/724-40-0x00007FFB556B0000-0x00007FFB558A5000-memory.dmp

    Filesize

    2.0MB

  • memory/724-39-0x00007FFB15730000-0x00007FFB15740000-memory.dmp

    Filesize

    64KB

  • memory/724-43-0x00007FFB556B0000-0x00007FFB558A5000-memory.dmp

    Filesize

    2.0MB

  • memory/724-42-0x00007FFB15730000-0x00007FFB15740000-memory.dmp

    Filesize

    64KB

  • memory/724-45-0x00007FFB556B0000-0x00007FFB558A5000-memory.dmp

    Filesize

    2.0MB

  • memory/724-46-0x00007FFB12DD0000-0x00007FFB12DE0000-memory.dmp

    Filesize

    64KB

  • memory/724-47-0x00007FFB12DD0000-0x00007FFB12DE0000-memory.dmp

    Filesize

    64KB

  • memory/724-58-0x00007FFB556B0000-0x00007FFB558A5000-memory.dmp

    Filesize

    2.0MB

  • memory/724-59-0x00007FFB556B0000-0x00007FFB558A5000-memory.dmp

    Filesize

    2.0MB

  • memory/724-60-0x00007FFB556B0000-0x00007FFB558A5000-memory.dmp

    Filesize

    2.0MB

  • memory/724-41-0x00007FFB556B0000-0x00007FFB558A5000-memory.dmp

    Filesize

    2.0MB

  • memory/724-44-0x00007FFB15730000-0x00007FFB15740000-memory.dmp

    Filesize

    64KB

  • memory/724-123-0x00007FFB556B0000-0x00007FFB558A5000-memory.dmp

    Filesize

    2.0MB

  • memory/724-37-0x00007FFB15730000-0x00007FFB15740000-memory.dmp

    Filesize

    64KB

  • memory/724-38-0x00007FFB15730000-0x00007FFB15740000-memory.dmp

    Filesize

    64KB

  • memory/724-119-0x00007FFB15730000-0x00007FFB15740000-memory.dmp

    Filesize

    64KB

  • memory/724-120-0x00007FFB15730000-0x00007FFB15740000-memory.dmp

    Filesize

    64KB

  • memory/724-121-0x00007FFB15730000-0x00007FFB15740000-memory.dmp

    Filesize

    64KB

  • memory/724-122-0x00007FFB15730000-0x00007FFB15740000-memory.dmp

    Filesize

    64KB

  • memory/724-124-0x00007FFB556B0000-0x00007FFB558A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2112-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB