Overview

overview

10

Static

static

5

49835cd073...2b.exe

windows7-x64

10

49835cd073...2b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2023 01:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    49835cd07387458f9a8b1d1cbc5be92b.exe

  • Size

    512KB

  • MD5

    49835cd07387458f9a8b1d1cbc5be92b

  • SHA1

    b0945ceb63cdac77834e7a22d0e6e832df976c2f

  • SHA256

    9fafc0c895dd9794412faa1191967076ab15c60b5dd1567d7ac4c502f413de96

  • SHA512

    b9ed7e19389539536bb166f2294e3bfda9391ad85288a3590c22a1cbea1c795c8ebc3e51dbfaaa3f0bf3c5e9bf453690fff40a47eda84cf5ae467a8eab2b3dcb

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49835cd07387458f9a8b1d1cbc5be92b.exe
    "C:\Users\Admin\AppData\Local\Temp\49835cd07387458f9a8b1d1cbc5be92b.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\ksjsdvxxpc.exe
      ksjsdvxxpc.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\SysWOW64\ptqjxact.exe
        C:\Windows\system32\ptqjxact.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2760
    • C:\Windows\SysWOW64\maqrzjzlepwep.exe
      maqrzjzlepwep.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2784
    • C:\Windows\SysWOW64\ptqjxact.exe
      ptqjxact.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2844
    • C:\Windows\SysWOW64\pkdpiaahkdscwpg.exe
      pkdpiaahkdscwpg.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2812
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:704

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      7bccbe3fbc22cb8e4e84e5ec4dd3d104

      SHA1

      6a6d343898ac6d23b4c5958ff139b60a55769d66

      SHA256

      d223abb2fea36e985f86ef3a66fa2e06182f937016182da02950ccc6d928c6bd

      SHA512

      4a6dcf685a3a0b1744ea6d5d10079d4e2cef9f3769b6548cfd92a9aa227db07e039c1a1376bb34869a470cff68db8dff6ac6598e517e78773ec9988ff9de23e3

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      7e952475a4dbf58276d2f157da1efeee

      SHA1

      ddc66db2d39cf80cdfc518c77e508cee7e5b3091

      SHA256

      8af957ff0d1dbd237c9311ea0521ca0b4db6b6cfec806b6bc215fcf1d8b881d2

      SHA512

      0fc4636090427f83ccb1adab3694647e2a3338c90e26fee02e9a5be8b9cfc41b27c3c38f80b24795eb7022076776b5104f604b2b6212dcf9edc325cdd098c484

      Download Submit

    • C:\Windows\SysWOW64\pkdpiaahkdscwpg.exe
      Filesize

      512KB

      MD5

      f085aeedbef948f9205dcbb8184f947a

      SHA1

      e8aef5391200736514fdf2b2bf90dfc60076f35b

      SHA256

      af4e3b096b32e1fe9d2e798b0edd9851b284e40983817a6a3b2627daba242182

      SHA512

      b15e792611520f84e60c4b4efa638b69983635f4cd7e9c882390c5b2b617d48d0a8a0ae31cb79631c4a5bd60aedd0880c5c835ce1bd1a1f98958749fae080df7

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\ksjsdvxxpc.exe
      Filesize

      92KB

      MD5

      6662b185f19fbf697c56a25c92de7961

      SHA1

      0df0c0df0de3724258df2549c583e3c934aca726

      SHA256

      c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

      SHA512

      c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

      Download Submit

    • memory/2040-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2156-45-0x000000002F611000-0x000000002F612000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2156-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2156-47-0x0000000070EDD000-0x0000000070EE8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2156-65-0x0000000070EDD000-0x0000000070EE8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2156-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2156-97-0x0000000070EDD000-0x0000000070EE8000-memory.dmp

      Filesize

      44KB

      Download