Analysis
-
max time kernel
142s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-12-2023 19:28
General
-
Target
37fa116ac75887bf0a2ec400e4ea33ef.exe
-
Size
255KB
-
MD5
37fa116ac75887bf0a2ec400e4ea33ef
-
SHA1
6687a2fec52e9322e76707705a595829824f9af7
-
SHA256
55edd1731f6160632379e7eab705be99fdb401c2ab96d2f1bef6925f6b7b8acc
-
SHA512
ddf0b68fda86e0f4b2a8d2c8fa61fa26a12c62416133e442da584a607e10659130537f3367274b21ad1841c6ed6cd40730b9e3dcdd4b548747895a3191481dfa
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJL:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIU
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 53 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37fa116ac75887bf0a2ec400e4ea33ef.exe"C:\Users\Admin\AppData\Local\Temp\37fa116ac75887bf0a2ec400e4ea33ef.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dlajvogbhi.exedlajvogbhi.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\omhxxleu.exeC:\Windows\system32\omhxxleu.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\ihucqyiumejkhqg.exeihucqyiumejkhqg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\lnlqprhlsjrdm.exelnlqprhlsjrdm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\omhxxleu.exeomhxxleu.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD516b943e01d2b29337abfb2d906b3e4b6
SHA182b9da5655256abae7365f04730ccd3c843107b7
SHA2565b94810ab0fb5bd331fb1ba81b61e8cac10114f058eb4c6bb829a00dfeba8016
SHA512a434d11714db49873404aa7ab0921cb8c31d651a4bf6243faebd40c98a7450e60f64fe8723fcfb0483beb21d5b314b94f0365d04694a52f7984d6783af84658f
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD5a10cf1516aea6226db874e654e095e68
SHA1fc89a37dec0a3735a193a1efaed6e8bb7410940c
SHA256c3920b01ec383daada6ae4df659eeb22819303bc8dbda4f8ba14492c993f6eed
SHA512e062af4c7003f055052174aa0c13da6cd093e507bd717721fdccd30e78d81714dfffe9eb8cf64746a5ac47168a27e3de9dc5f0973fbf3e0569da2563a34aa1d5
-
Filesize
3KB
MD5c9299911c26ce3b2f95a1c1ee7bd2069
SHA1b449be1f648553b35e375f2f4bc146b9a2f8cbcb
SHA2564c6760953c753096b12d4a74a72eaaeae01023549503e93a38ba8ca3fa4a4b8f
SHA512052e77fde40f0bb297547aea943d6f9be7393f2d9a02c42f23998a1b7c9f2e7492ae2298569a590d455cf00129ae1fc955ade4404bbc778a088ce8fe49c1a580
-
Filesize
12KB
MD567d5e74293d75e3051633ae24f8da2aa
SHA1200f5152bbc191ab0c54fad0c17d116bd0b6a8e1
SHA256234971a7befa49587154f588bb612da47e8f7ab474c9bffbb06258bf8884391f
SHA5125c84d50b16d7d362fccf00077b971603f24e08a919e1f9ba99f162c503eea3cd9890222a0a60f62b7a7faeaec955c8a09cecf335f3d0f0d8dc00203ebf2661ae
-
Filesize
18KB
MD5661a1d89c09313a755eb5c9457a80155
SHA1f7572f982e778e3f3ce0d8ec1ef86ad85918d0f0
SHA256f774192781dde5fa10facc7b8fb3a9b7bc62813e566987d7f250f2b1a9839eda
SHA512b1552349a275a4b5f3899993e327d8228ac9abc9e61ae6b71840f30f95d049307bef19f3328eb3729f627deaa9395ad941696c1311324e73e81ac785107f7404
-
Filesize
204KB
MD5f20fabf29d8b67e2b9af5b47ccd0237c
SHA1aa51111925055b5a95c18f8c6aa787d3a0307910
SHA2565b5ee5200149c67f50e2ed2a40198c21b1a5622272822da204a9fe696e086024
SHA5125f20b12cb6bc2c502d5336ccebb9c3df4b2cdac40e9377779f7ba8af098b0851b628e515a79edd0fcec2ec6c61799fe44900f79f85125d0c7b0df29ed01b6de4
-
Filesize
164KB
MD5ec458ce1cc80b15913f3c1761f80c149
SHA11b2b1d5e322d73ea98857d64bd6632f66d4920ca
SHA256e2f016e5160cb677a1e1b14871bf43e636ec8d0ed5fc797698f93e22bf89a70f
SHA512c844950c472b635d485de0d2727ee2f658f5f30c1e82b90bb7bb088bd425c876f372b418959bad07497851dc3482c9e390971ff4b3c3d2bd24193382a5db7df7
-
Filesize
232KB
MD5785a41a42d3e50e24f74d57e3b7c0c92
SHA154f8f0732ec979feded383475bba71b100e66ea8
SHA25620a2c81cee2593380ec1ba94057ae6d0bd2959186e6ec7a57e45ea5dab5396c0
SHA5124c6028a5b7c5b6cb42fbdda95140105861d9105a5103e0c0e09732ed30501d355d7e35e9cd8418898ae0f23df99506a8de9a4dd9968aec5d5a8eb188b5af2d82
-
Filesize
199KB
MD58bfd1c1689268778bd5b47801c9e4aff
SHA143c704929dfb46c872c0ed007b401cb5ac7f5751
SHA256fc10644d65e21e633be01dfc12b6a25497ecb5b7d3c88b3ca1786f1a68be313f
SHA51230a0ebd4a6223b4e412598ee6040a17264fe114d6caea7a009db3662f33c0f6516959b8dbdc2ccc1e3e965c8f668448d8498bb12bef97495bb5e4fc89d81b15a
-
Filesize
255KB
MD563fc0637dd5764daddc7b825cc8efda9
SHA1b603500066c10e59c2fd98463da1c6a5f9b362f6
SHA25603ca02eeb8fba33ebf652cc3e215b1f305c0b6ff4525e12d90c888c026b41728
SHA512ac2bf5172db1bff6e22d3fba99185ea81bda0376d6d2b5849020f1ccd1a7dab50359ce564f9cf46aa53bacbe8e018c958013cc3f45d9216a2fed2848f0797ad5
-
Filesize
111KB
MD51eceb5459802db6606bfbcb50d1deb20
SHA1cffc5dc24e47ca8ba2b7510af5832234157d53a1
SHA25633e914234085e77df5f360225b455d8d9a3d1fd95a90c4168edec1282337b4d0
SHA5122e7869fdbad9bb363a8ccf0b78aa60ec8264bc38000729e1dee185580b8ca51460d219f9161efd2bfa9c488b8185f053428c5f95416eed002aeb453b76982b81
-
Filesize
159KB
MD518b1966b7efc29b4e580724c5104b648
SHA1f618c1d9aab6966846dc57d9d994abdf09de20bc
SHA2560e4ce5ba8735c60a98867be6625d3e3bd5615fc67a613b2607ab41f800a9d4b7
SHA5127ecc8ee2ded418ed45580af3e834d840d6368bdc351eb6e543699488094391ae2e710b6cb8fed4fc9c7eea906a4f56535654286d1171107e89e42e2f112d1a78
-
Filesize
92KB
MD558a6eed33f4d75df680334b0867322a4
SHA1ad1fc6edd0c4277b36e9d691ba4bf48eed60c133
SHA2565779414ff0d6363fb1a68418cc9e011c406a64f1580776e8bba0c94c1a825546
SHA5128f1bf3e706b6a40e9a72ba2befb1508d7754e006752fa4c0c1411f0e0ece52023fd2e550f995fd6b9cdb91c5df7e673d1a212db69f4cf0414f8cf41832a25c1b
-
Filesize
173KB
MD551e2d189996f31fe87761b4036cea8b0
SHA14a0af32c5475802d073fd664abf70bf57d508062
SHA256ae990353d0fe571836bbe3fe6b7d6885b5e0adba9015103a99bb3aba6226941a
SHA512b1985b9344b0662aa5d2af8b5d740a975b389945ca4974e63b0ef783d5d99fca066d89d4b4afd06b76bc0874b5c962e96ad949f5b3d5a437615c34bd336209d2
-
Filesize
102KB
MD5ea1b85aab1b6c3e32b82f524a73b4bda
SHA11c470c824c931f8ccd7fea6ead2943e64fdd17b6
SHA256994b5eda2c0042d0cb1083d0982bfd76494c9e48c77a57364c456e9ad04f6d8c
SHA51235139ce73c3c46836b5583036487592292f8258972e10cbe20ac0a6f4819a000089cfe045cfd4fcaacc9fb52c1abf619cdb23cc86bc1ef2ec823cefa8046d1ee
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
43KB
MD5b539ab50e82db5475706cd1d22d37a52
SHA1f7d4638b4d803a1486d409b051688d43514fdd52
SHA256d319e82996a7d6e846aee3f77ad506f31aa48ca5d635398b54aefb5fec0ffcd1
SHA512490cdaea3f2c60ebee48d82f1668eadae6173d05c0a36e65de4f8ccef0ebfee5308a284c55a7f2772d9ab3d0ba6abc6926a18498fc75fb90113e1789b2818bd9
-
Filesize
255KB
MD5df359edc2a488e8f10cee1a5ac5d23ed
SHA1509faa608675d4b3254e6b19963db6cc6a569f38
SHA256311d819b7a0eb8880bc87f24e03e18675078cc8c2a6b0ef0f6ae942e3a06b363
SHA512ae8cd12276a1adcbe331e3c3ae782051b27c2a20d8a34554767116917d34095293506ddf3896365a367f934db1eddda43fcea6ab56a8c6c95c8db9152666f248
-
Filesize
154KB
MD5b379e9a82f113ff800cb96ec0b2a8da7
SHA119976efa85c82f4eefae608f7f362897a1129a04
SHA2568e799598984674b841f01dfe4f0be784f474185e83330306249b720dffecaa04
SHA512720f9f18118cb739db4a2222af706dfc5e22c6fe69ad31bbe91f7ea7d54930a180242ec7437100fb347e11b35a31ab98e39d7b2c73961016a676028a36344939
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB