Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/12/2023, 21:17
General
-
Target
3d1b9631c5905683931200fd58d783dd.exe
-
Size
512KB
-
MD5
3d1b9631c5905683931200fd58d783dd
-
SHA1
2e95612519872978c8675b7e8bf452f99c89b91d
-
SHA256
7cec07093cce87a490295124a8bf53a101d6d4452ec5c4c82b273cff23db0518
-
SHA512
f3123bc89ad9bd7d4329b954abacc8b357ececc1941cb821abef6515bd655aa84dd77e475f7e3bd46338798cac17292b9f8dab8e97bfc7b48562b1607e8cb1a8
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 21 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d1b9631c5905683931200fd58d783dd.exe"C:\Users\Admin\AppData\Local\Temp\3d1b9631c5905683931200fd58d783dd.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wolfenussu.exewolfenussu.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ouhgkoms.exeC:\Windows\system32\ouhgkoms.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\yehkcgoyefpbyjm.exeyehkcgoyefpbyjm.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\agtwhhfuxslir.exeagtwhhfuxslir.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\ouhgkoms.exeouhgkoms.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD59c142d3544a7eacff868996e12663b68
SHA1359b2672bc9a634fc0a91570b073e28fcefa8fdc
SHA256ea3d42319f5bf1365fa0c1787fed60f36a6850b6afc3f52594348ba81abe4222
SHA512e699c7cb4e9e6c2a380a41bf5ad161f1e10f2ec64f591e3a36f96c95a644afda1adb888c865e2175861b2646cb5fbcd174f251aa1d77fd88647110ecc3a9de5d
-
Filesize
5KB
MD5fd24b047026ac27d05c3ddade37af7cb
SHA1e8808f79ef67a39f4e685069c38fa5ccd903aafd
SHA2569673b421de1b4a838b59c71bc9ff3ed5e4b633146b4640c46368ac302ff8d026
SHA5122ba10ac7a144f2c330df1a5f480086fd657e8df767375550f4638ced1d767840a934161411c1acc690fee593ca0f30fa47087a2e2dafaf880f72f79c03161965
-
Filesize
7KB
MD52c2020fcfcbe09b029635ea43dcab5a6
SHA184fb73a474696163feee21840df76d954f01d3a8
SHA2560c2ddca3cbbf4d51d48e6b0911141164f5a2be9e633c9338dd86c653d27ff10a
SHA5129660917a0606cdf8fbb15db73f50f4976a6b1d435652912d82953324ac8a5826792d3451e9bf3a7b6f4df7c36ae20413bc5a8b9d901ed757662bdcdf4aa01dbe
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD55e8185e0900026a4e179e661c6add996
SHA1266fd32c4f71739fb2d2b6dc2188abe3acba2a8d
SHA256f2624e2fd6338996febd21bfdb356a877b3b0dd4c6ab5866930d31b063996414
SHA512dd7ecc874bc0f5281eb2c309463a01995e071b470096ec9ea5f078d99d14ec5e512ec50017dff19abbf66674116863cc28a61c6c7a7c4a1143ac6abf5428d1ed
-
Filesize
3KB
MD59ddb8dbdd1c105ae458866f46b246eb9
SHA151fc368828f997afb752683a324d28f99f34a112
SHA256aeb48d07b43f4bc295ab30afd2f83997d09c193849d13c4d0061c2d21b90fe35
SHA512e956a682f742910cad7edf00b1ee2d856028f0acacda29c46ab41249daa0a48b1031fa5af203e8281276666fea8737a73305055b21543dc42a5f634e9f2b2647
-
Filesize
25KB
MD5cce8a3f14c044d713a42bc78168ebcf5
SHA16f0c43628da4ba84e81003f31ecdfa1a71284b7d
SHA256c5e381d9d6d228a40858dd2d48afee4c2a3fe25461691ad22d807572d2fec676
SHA5124c6e9af4f867266ed820d5812d686c642eb3a48daab5494ca267a4c9c2545492cf1dbbe9185cf70f8123980e71ab8b00a6798665696a2dedfce008ceeb11e94f
-
Filesize
13KB
MD5ea9452198e7e353f191c5bad65c10627
SHA15e639e49c52ba7c5641e7601f8660f1a1871fa0e
SHA2560d38279462b8734299db91a9d8363e6e0031c1709d1e9f290ad276f91dd4e4dd
SHA512939b20c86caaf9612990db308b84123baa17aa76101f259b7373701f5e7b4eac0195d3af173b0df30219d7701e67a84a66c31b03a95fb7dbd77ea59a64307e82
-
Filesize
1KB
MD5ec89629d437c17787acc7061c89e753c
SHA1c65089b32eba1cf75d3546335718073460c971f9
SHA25687b17909878537f2c3d3bc046f54b9eb382e312fa75d2b177457a978dcc7d83c
SHA51265f02cc30b64e2c33d7287c135bc0bb20abe1e35c7176a03e47403db3e21da28f7e7ec7a13ef748aeb76ac06e5e159a9b4e62196692c3411459a4ae235a1bec9
-
Filesize
38KB
MD5a2b85bc5a4396d67e0b04ef1209c904a
SHA11623632abf6190a0deefb0bd82639267102ecf2e
SHA25660b61093f0c42e736589d65006f3f1fa950869be524fc51c2bb034057cb1954c
SHA512461cbcd6b5219644f692591bdb0c52e970dfbed4297c942ccfd16142d56070e510be11829585690f9f619c718a4b084853af55f726e04db24f46d6047d67ba27
-
Filesize
24KB
MD5ffdbc494e805e37ec3b0ba287b8403e5
SHA142614617f30db6b9115b22d411ca3a3f4e8c55be
SHA256292de84cd64349c6dc5cc5f8b1878cfd5285ecd418db4b333eee204f86b01d66
SHA512f3eff959cd2dd5ad84bd7996ee9a7d02b23672314e17a1d5305db03f462c469d8f40eeff91e85e014791d280dabacc314a512328631210f6094861b862d80e4e
-
Filesize
100KB
MD52cabbf6d07b40a94f6702028dbcc3e8c
SHA1a4a79452ba5b7f57d172f01adcd6cc07d2d2c5ce
SHA2564ea6a4d2cc996d9532f7c68f61d7dcc526a09e8e3cc58bac29dcef3d60e1e581
SHA51263c8b14531ab8bfd503aac49298b93eafbd476336c63cd030b9e6e500a2665338706131d6e11e228a8e9830a98fc6acf6628c1d91f08a8c72f448ec480ba0a34
-
Filesize
80KB
MD597a739716938c47c8f30f178cc5fde13
SHA1a767de18bd4e16f506e529881acee321b93da3a9
SHA2568cf7d2cde69ec79475ecbe2a662f25b9255c3ffe10771a279eefbcd1bec26efe
SHA5122178d0ebc8e729dc08b80cecb4cd7ad29ce02a3eedcf023bdc1d6a0b5b02d1dcff4c44a2a2fd37751673a8057d625208e8f1f28f1d171a0e59ed450b99d1eebb
-
Filesize
111KB
MD5aa43a28b22b05918e5ce66890a3fd721
SHA168ce3d671eea3125986d914d358fd379486aef1b
SHA256bcd27954ee06e1172c1e5edc53e5de4cf40b02a916b68a7a5b4125bd351587bc
SHA5121c6e20ed47dd6404460dfa937d6936b552ac6dd9d5d9a7aa59782475fe7e6f70e483f8178249cb4ff5e5bc908610deddf63d236c536b884bbd9e439e91e58db3
-
Filesize
32KB
MD53b7b3ae7203607f39392e29d2255b8ce
SHA12fd81184a7a13b5968e29a4fcc8c5c9e1fcbc078
SHA25647d9a990e3e33a931eef17e0b3c492d257e5cab739ea62426e376f140350794d
SHA512195462327d84e6b056858187f96e59ebaac4f242cb1325b90ef464ea49caea96bea67e21293850536672ca87e44d236661e1c75b5d94bf1ccb1049a34bbadd5d
-
Filesize
22KB
MD56709fbdd5f5345b881d1b5fbb6e5c1f4
SHA11d21d666dd7c42f5c4e4299fa6266d3e4cdd4eec
SHA2569fbaa071a91cd6c917a0c0f3d56efae19a49dd7de88a503c0844c2dfb0e0dcf5
SHA51246576aa99ff2fac4c2e2de0c40a36e9a10e8a789f2d2e9b661bf9f37bff5e3a381729056cd281e33644b7c791e75abb0414cead39140c3d047e55ab7adf012a7
-
Filesize
71KB
MD5a3a5011df8771a9baa800b488c27cb98
SHA13a2394560307a9bbc3aaf9bd19e076b8249921b6
SHA2562d77311ae0a1675d117b93f2f39ca7f907b342852b4707fdf9e8de7210ce1100
SHA5124304f45c060fa5581145f7d45216db2504d06bb7dfec667f5199a1d862d1f867933e25e09ed22fe76060a7087fd5bb3ca3fc50b62fcbe3af1033b5d76be236f1
-
Filesize
112KB
MD55952f67d82c43a28d6567723c6685f42
SHA155e10bdb1d074113ec6029ef0b7345b0d7a5e748
SHA256ee40660002f8b19c08fde755b9b665bc9c6bf30ecbb04740bbce5cb283536408
SHA512316d7852077284ec76b864b803a41a8c0d5553039a877e977d48c3d8b8d6bb29083cf903fccf91200277c761dec75fa1492b165be8365544f6d6063361ffbb34
-
Filesize
81KB
MD56999a2fda0cc0dfa783637a000f79a7d
SHA1d6c07462af6bf01d6912ad17cc97fc1ab6eb6ebb
SHA256ce9638efe63693d80ee40161108b8d7d585fd68de4ffdddc5185abd8d939cbe4
SHA5124fd6daad3cae64042d9bc0d416e5e50575a61092f8512dedf250c8a2bdb43580a88e3a5cc0f071b71a0a714f7d010db3a7047bb8f984f245efea0f5556586e14
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
90KB
MD51d87ba40feacc74d269f11fe0557a274
SHA1a4ba269fa435ce0a4cb66b3345242a66aaaae97b
SHA25667ac182c9a95fa80024351df39921d2ad03dbda9d9b400daa25b8cbe99610b1e
SHA512000068d944bf33d87a854f20b04495def65ff31a9c1ad45262666dacc0159f204236fd891115d406d83fe6b1914cf70bd24502cb2633fbf1c052aea89f1677bc
-
Filesize
188KB
MD555224960b7d98730ace87bf264d99b27
SHA19aedfafd47df8bc7a52b0e204951841296221df1
SHA256161ffdfab2ba1d088c7be68661348b4dabde3e96696bfad9e7f548bd2bf1986f
SHA51269edab17b4c20b1d993fe6469b1e17a6143f6bf6780b191659079bafc8319e39ad8c77cb932cb21654dec7ed0b6e2dca8045e6591a6431176e1fddca6148ef4d
-
Filesize
110KB
MD586a3cce83674178e6b9b2fd55ca5cfc8
SHA1d0b8cb37ba2687b1c2b82c439bbd83a711f642e1
SHA256327272c07a13c744a46077b2e23b4b86516c2485f4d37264c0760a25fc1ade2b
SHA51259a7699c9366a3d12857cf2d3bd007905a00f7708203b26ff0f092becff21e6ce87acaf633de2e46eb68ffb6ee6796fbb9c09a56a0328f7fcc84f81267016262
-
Filesize
118KB
MD535bc43784022a1bd182cec562c8944fb
SHA1da69dd6f5dbcd6512ccb9c917fd6414496e5621a
SHA256eb0ee88788037c9d3a8916f2013bc73c274050d25ed0232151f9b6afcc2b2a2c
SHA512e421cfe0900b8f10340a816b6c2b82693fb2f7ffca40513c72dfc708d725cf42416009e2289d6914a7292f190ca2aeb798bdb880dc39da267583507e08dbd03d
-
Filesize
600KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB