e4b2fc33abe3dc443b121ff0c08bebf6f0c698b4d47bcb30ca6c793adf4f589f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d5fdb723ac312194c77d01633b65e41.exe
Size

116KB
MD5

1d5fdb723ac312194c77d01633b65e41
SHA1

62243a731d6a6676b1d0236a6ae0997b827a305b
SHA256

e4b2fc33abe3dc443b121ff0c08bebf6f0c698b4d47bcb30ca6c793adf4f589f
SHA512

8da78235df204e91595069da8a57cccafec93c1a69d25d04f727ceffbd8c535fb51a19e74789826162ec64d218441989f04e8b5d5da006ceedf6059cf80155a0
SSDEEP

3072:98RTVXDNJqxSA5HDc3I3nNoOsRXurRUQzj+5n/U:SZRcx5VMpOKXur2Qf+5n

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3684	Idolia.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Idolia.exe	1d5fdb723ac312194c77d01633b65e41.exe
File opened for modification	C:\Windows\Idolia.exe	1d5fdb723ac312194c77d01633b65e41.exe
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Idolia.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	Idolia.exe
File created	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	1d5fdb723ac312194c77d01633b65e41.exe
File opened for modification	C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job	1d5fdb723ac312194c77d01633b65e41.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	Idolia.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\International	Idolia.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe
3684	Idolia.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 3684	316	1d5fdb723ac312194c77d01633b65e41.exe	69
PID 316 wrote to memory of 3684	316	1d5fdb723ac312194c77d01633b65e41.exe	69
PID 316 wrote to memory of 3684	316	1d5fdb723ac312194c77d01633b65e41.exe	69

C:\Users\Admin\AppData\Local\Temp\1d5fdb723ac312194c77d01633b65e41.exe
"C:\Users\Admin\AppData\Local\Temp\1d5fdb723ac312194c77d01633b65e41.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\Idolia.exe
  C:\Windows\Idolia.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Twain001.Mtx

Filesize
2B

MD5
309fc7d3bc53bb63ac42e359260ac740

SHA1
2064f80f811db79a33c4e51c10221454e30c74ae

SHA256
ac11339ffa8f270c4f781e0a3922bb1c80d9dee6e4b6911ca34538ed9ae03caa

SHA512
77dd27d30f4e13a0bcd6fd27ae7567c136d87393e5ee632bccf05b0a0d2bbcc2fc0fd777a8508e26cc4fc579c8da0ab56b7bf179b1adc70f28f7d0eee89fa5f8

Download Submit
C:\Windows\Idolia.exe

Filesize
24B

MD5
e3e11a24fee857747c3345d513e118db

SHA1
0e059db3de6eeffe408639c045b6a037fb4ad49d

SHA256
d691313bb94772d449949a2da4e80b33b1969caaa59d73251ec4d6e84532f2a0

SHA512
1e1e0aee7a5ef56e1c92315689869dafdc76ff8e335b2d4c2d471b6de9a5d79299a5673b72691e1ab2b9d641fbe61842c71d8c8d7fd0d5d255ee4fb65ad3588b

Download Submit
C:\Windows\Idolia.exe

Filesize
13KB

MD5
5a7e65ce3abf6db2f08acd033a08c727

SHA1
b7e3f15ceb2a4c3c134c05ba9e6ca9b60daf64b9

SHA256
aea5fac097033474dd7d34dfe30b8f19cae266e60f6c8f2a5e414443665c5696

SHA512
81f33f0823b2cb5ff5516cb9a838d795bedd4b56b68568d5a737d670f36dc1d2d1304f6188bbd1b12140e95a9aeb780eb5e87748f1db3c000004b58e9923f7db

Download Submit
memory/316-36685-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/316-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/316-1-0x0000000002240000-0x0000000002263000-memory.dmp

Filesize
140KB

Download
memory/316-15309-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-50624-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-22985-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-65672-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-80500-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-103346-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-132717-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-134949-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-135466-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-135467-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-135469-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3684-135470-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download