Overview

overview

10

Static

static

5

6598101b43...af.exe

windows7-x64

10

6598101b43...af.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 10:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6598101b433c5557be6c2226a1df29af.exe

  • Size

    512KB

  • MD5

    6598101b433c5557be6c2226a1df29af

  • SHA1

    f359e8a5dff641ac74aab026947dc7f48e3cabdc

  • SHA256

    02ac4db0e6c3150abdd27d71e7a5cd4ba3b2e75eeceb0bd9f6410616e1a44861

  • SHA512

    83d6601059110c199fadd51b6cc44009fa1534fe35c2e5cdc7be88464ea0465fcd8c5faf24b3d7c9a5145d38bc140a585fc586ea70cb243a12ec63404b5ae337

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6598101b433c5557be6c2226a1df29af.exe
    "C:\Users\Admin\AppData\Local\Temp\6598101b433c5557be6c2226a1df29af.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Windows\SysWOW64\jmzmxeabjh.exe
      jmzmxeabjh.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\mrnoebuj.exe
        C:\Windows\system32\mrnoebuj.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2656
    • C:\Windows\SysWOW64\vxqlvuefpmebern.exe
      vxqlvuefpmebern.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2840
    • C:\Windows\SysWOW64\mrnoebuj.exe
      mrnoebuj.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2852
    • C:\Windows\SysWOW64\tmzdgyvllrwuc.exe
      tmzdgyvllrwuc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2744
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:808
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1724

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            afd684d733a6d5f616904874c10462b9

            SHA1

            8cdc461a0eccc5c6c5ed357e629a3d2190d54fe9

            SHA256

            d4d97da4fc9c9f386ca4437affa58977dd98dbe9032da4f17ce75e7f7f0b45db

            SHA512

            31f745580c1517dbadce058634df4040e38800b2a3cf2a8175a0b99dc37ba2f39ae850f9fe1b3f90e4a652733b7ca1c69eeedf5fa77a5ebb2775bcd41eee11b3

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            10de78dabbba5645e4484ce89ae07c5e

            SHA1

            903aedbea88001db9088056aede389ca3727c4a2

            SHA256

            267f5266cc64cb924a9b2ca37da24702742f33153f2b7989c5389bbd06cbc1c0

            SHA512

            ab433833525a9c0b88ac563637759780d85466de7e2cb1a24e287c57edddbd3198e81c0e978c173c4e323e8556cc4b7b61fd673c3cdffe964288424eb920a477

            Download Submit

          • C:\Windows\SysWOW64\tmzdgyvllrwuc.exe
            Filesize

            512KB

            MD5

            29ffb213c961ef648aa094422622824d

            SHA1

            559a6ad4296db3b5340292e3d9d63a598ef9458a

            SHA256

            2df5dba80a837b218ab1e71a90badfa3a7175956fb525f1c797553f7b7c98db8

            SHA512

            15e200a1cb03d200bf8f8df124119b11e03eb777679be9d0e2a3ec262b02afbe84f259e0587d89e50ee65650d6092b8a0936ea0e0bbcd30773db43aafec2b995

            Download Submit

          • C:\Windows\SysWOW64\vxqlvuefpmebern.exe
            Filesize

            512KB

            MD5

            494962eb4220d8ced677db1660b9e337

            SHA1

            33f6898dfb6e73b813bd0e33202466dec679b44f

            SHA256

            4438a20814379456e927a81d386fc3e1c71b522eaeeec49983a8a02d07b5c5a0

            SHA512

            61f4859f905d4dce8da22ac1f2442e63840c1228cf193d32f004b97d7a3454dffa5b9404ef3536e67d2e39173a57d3fd99c14ea6da024e9c1ec6afbd88667f85

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\jmzmxeabjh.exe
            Filesize

            512KB

            MD5

            9930a445fda91c83a403b24bdfdbaa74

            SHA1

            eeae474003bb70abf9bbef8dcdf37d36dd77a228

            SHA256

            8ae850da14978a787d1792e19974a864f8df8c5fc6345ebc93dfb245f679868a

            SHA512

            cc9fe2dfb6a0e6d49eebcfe16b0b3d54a26d84199252ee47d1c0b8cd6370115cc4cbb142921b53a82c9cfe9ce3f5106f47f8f77bc4bbb39e1bcb9690f86bcc7e

            Download Submit

          • \Windows\SysWOW64\mrnoebuj.exe
            Filesize

            512KB

            MD5

            87dea44ac5381f3ef98bd3e5de1ca5e4

            SHA1

            de0fbbca4d83685f36a9c0fce218cb46585189ea

            SHA256

            2acd7e2a0aca444a4ea61456a34a36c55d0a7032c4b546db2fb859978e344156

            SHA512

            63fb7187d53a83c758d36cf6b318bd2344bba35a544e2913f46a126e5b35f53ab6a99d39d31de9299013f813f2c6f8846a21c5b44e7a7e868c021522eda9899e

            Download Submit

          • memory/808-47-0x0000000070DDD000-0x0000000070DE8000-memory.dmp

            Filesize

            44KB

            Download

          • memory/808-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/808-45-0x000000002FBE1000-0x000000002FBE2000-memory.dmp

            Filesize

            4KB

            Download

          • memory/808-80-0x0000000070DDD000-0x0000000070DE8000-memory.dmp

            Filesize

            44KB

            Download

          • memory/808-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2256-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download