Overview

overview

10

Static

static

5

4847aaa448...a9.exe

windows7-x64

10

4847aaa448...a9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 01:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4847aaa44890beb22d5996522ee45ca9.exe

  • Size

    512KB

  • MD5

    4847aaa44890beb22d5996522ee45ca9

  • SHA1

    27f813acad53a24939c8d773b208332ce42a81c2

  • SHA256

    d722b5e315155a3cf92c7411b92c57f9f6e30e212bb768c220ac3888e9b0a405

  • SHA512

    f690d3944bf7c2f5f910904cf8d2f7d5dbd63ed4bf60655dc11613ee1ce4a3a3c05327c822f8ee8d44286aa43f63c82b04130680dbd49c102b87e1027e842603

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4847aaa44890beb22d5996522ee45ca9.exe
    "C:\Users\Admin\AppData\Local\Temp\4847aaa44890beb22d5996522ee45ca9.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2068
      • C:\Windows\SysWOW64\ikefekabokkil.exe
        ikefekabokkil.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2928
      • C:\Windows\SysWOW64\kticxdkn.exe
        kticxdkn.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2728
      • C:\Windows\SysWOW64\kjkxpmysoaqlgsa.exe
        kjkxpmysoaqlgsa.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2888
      • C:\Windows\SysWOW64\olophijeyi.exe
        olophijeyi.exe
        2⤵
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2724
    • C:\Windows\SysWOW64\kticxdkn.exe
      C:\Windows\system32\kticxdkn.exe
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2612
    • C:\Windows\SysWOW64\ikefekabokkil.exe
      ikefekabokkil.exe
      1⤵
        PID:2860
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ikefekabokkil.exe
        1⤵
        • Loads dropped DLL
        PID:2876
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2644

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\kjkxpmysoaqlgsa.exe
        Filesize

        94KB

        MD5

        adf240d1843e40ab9617e9dc12bc9b5b

        SHA1

        70923ac6636077728d2721b22d312002f735deea

        SHA256

        f53d3e249050f489475559b9c39548a2afb7157dbd9e87551ef5349fa76ccb62

        SHA512

        e2aec62114f1f6b5e94e0888efc2758e284835e0099abbfd3dd80cf3500a1e0d628c3ecb66b6b48fe051327746af38f2e953e1f816819c6b18126212621e7ccd

        Download Submit

      • C:\Windows\SysWOW64\kjkxpmysoaqlgsa.exe
        Filesize

        384KB

        MD5

        0e151ec3919b72f9a6c7fe60d10f4ea0

        SHA1

        91fb01badc6db9808233ff95abf39c37982a8c85

        SHA256

        f644299fe8f10c5f3e24c1943fc808270b5d4f853e2316abf091c8d18344193c

        SHA512

        41d25f82ce04a14c21d19a9ad2d12663714221b6ecb1c3ee579a4a134949de0bfb3e6212e9acf97d0659d50e7a034dcdc103ecbedd8a71fbfefdc30f5728c12b

        Download Submit

      • C:\Windows\SysWOW64\kjkxpmysoaqlgsa.exe
        Filesize

        512KB

        MD5

        02e1b523fea4efa1a1544d8124be7a6f

        SHA1

        6be2bb85ebc3d9378db4f54884ed216607bc93d0

        SHA256

        cc2e6f396dcaeecf15f1ab6ab608b731150e635c28d7eeb6b7a74a1d58da6a74

        SHA512

        68579181672c392dc3d2135e709f322949f783ffdb11ba2f7267b58f17265078b198693298bc61d05c9f9901ddab4b7fb786e3253224abf7a1297c7b80ef8d4c

        Download Submit

      • C:\Windows\SysWOW64\kticxdkn.exe
        Filesize

        512KB

        MD5

        982003e70936c5828ba214fd1e84031a

        SHA1

        bf76da69846922905ff1b796cb6682775d553e69

        SHA256

        9ebb5c442ea328648ac907e05fffef96da5ebfc87575a376495af06e967d161d

        SHA512

        774a5d8bf98d1a95228b4fb69cd307cb3d847b4af405fb05fe5ff19d452a120045261b77604b657f4b86b4551cee3f9d92b3fa3e99cf168803942c0bcf3565de

        Download Submit

      • C:\Windows\SysWOW64\kticxdkn.exe
        Filesize

        92KB

        MD5

        59ebf1358a9b829f5709baaedeeee6fa

        SHA1

        1409fd65da1b814db0a08feae54366dfca196f1c

        SHA256

        d251f3126813d9f42461b0d23153c37c405979347a47fb0f04e0503beaf31a06

        SHA512

        a2d71b94a087aa6d376f4f065d9f7ff987fd50ea93949372fa9ef5b6692b45cef7ae267c88376b9d2953e4476496f67af1173e9f0f8ba81101dc94c6872cf417

        Download Submit

      • \Windows\SysWOW64\olophijeyi.exe
        Filesize

        512KB

        MD5

        e355af3c7949c2b444eb6793f0b66503

        SHA1

        cb0408ab4c109c56b90cda13567e5b773c9ec176

        SHA256

        4488e86e3c5290adcc171eb5ca170187663298d1cb43a85727cbb5a1c3f99a3e

        SHA512

        ab06ab97a6f9c5e0523d3ca4f374d9ffc4935125b7e59cd95c8695fa2efc1b45478fe4546d3903d0177dd717e2d611a2ecc41a34562c690d3636e475fb38ffa5

        Download Submit

      • memory/2284-46-0x000000002F141000-0x000000002F142000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2284-48-0x0000000071A2D000-0x0000000071A38000-memory.dmp

        Filesize

        44KB

        Download

      • memory/2284-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2284-89-0x0000000071A2D000-0x0000000071A38000-memory.dmp

        Filesize

        44KB

        Download

      • memory/2528-0-0x0000000000400000-0x0000000000496000-memory.dmp

        Filesize

        600KB

        Download

      • memory/2644-87-0x0000000003F20000-0x0000000003F21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2644-90-0x0000000003F20000-0x0000000003F21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2644-96-0x0000000003B10000-0x0000000003B20000-memory.dmp

        Filesize

        64KB

        Download