Overview

overview

10

Static

static

5

051ff21bdc...26.exe

windows7-x64

10

051ff21bdc...26.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 22:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    051ff21bdc212a57f9566453dcd94626.exe

  • Size

    512KB

  • MD5

    051ff21bdc212a57f9566453dcd94626

  • SHA1

    367aa83efed957dc3012f9d6b03194e183127ba6

  • SHA256

    05614d9b432c03e510b8b2ec3b318ace77e5b64d6ea6e4356d2b72bb5ad3fc85

  • SHA512

    9ee34c73758b014164ee3da4ca7d66ed150d080e1112df7fad13ae5175f17d70655aaf81d03dc0fea1828e3d1e47546dbb31fd9a973f82aad071ed47a705ba84

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\051ff21bdc212a57f9566453dcd94626.exe
    "C:\Users\Admin\AppData\Local\Temp\051ff21bdc212a57f9566453dcd94626.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3332
    • C:\Windows\SysWOW64\ygwfnhac.exe
      ygwfnhac.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1004
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2488
    • C:\Windows\SysWOW64\tmnstkfkepzxy.exe
      tmnstkfkepzxy.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5008
    • C:\Windows\SysWOW64\xeafrgyvfgxxkqe.exe
      xeafrgyvfgxxkqe.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4708
    • C:\Windows\SysWOW64\lrqgaqupgy.exe
      lrqgaqupgy.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1476
  • C:\Windows\SysWOW64\ygwfnhac.exe
    C:\Windows\system32\ygwfnhac.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4544

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\lrqgaqupgy.exe
          Filesize

          512KB

          MD5

          856816cc593137aaf0bd8bdd51e02974

          SHA1

          bf710fd6ace89c070214ba7bf36ef3866aef2f27

          SHA256

          b0a6ebe1136148ddd7617dc7773b63d18af0ccaf2bafcdac71d17e590ad0177c

          SHA512

          e196745117b75f4a65d824707bd180a140b476ae55b16a1020f7a89c698ef6d00ad5bed8f54a1f08d22f59fd36547e5b3eab5b5a7eeed20578b669ed24cc3cce

          Download Submit

        • C:\Windows\SysWOW64\lrqgaqupgy.exe
          Filesize

          418KB

          MD5

          f188b9544b1c8ffc47805e11cb39fc2d

          SHA1

          4149bc219294549e810ca120377471ec7ef05a00

          SHA256

          ae8d2465a79e11d9ed8eed2d1f6a67590e346e86e335d9c0cebc33ccdf14d24d

          SHA512

          4b478b2e3730c686beeeba50138e7a2429125cff49c644d0bec06c7ec314d19fd08faa31e57e6270d2920d12770a916f7bbb897963ab62d46ee0de082bf930cf

          Download Submit

        • C:\Windows\SysWOW64\tmnstkfkepzxy.exe
          Filesize

          96KB

          MD5

          97ebe3e5294035e674d3a6df982e678e

          SHA1

          10bcf2334dfd7bbc1b2a61064b928c155a7ca3f9

          SHA256

          d7882b4cdbfa3b49c93cced26e1f896f01b7dc7b1b456933847a9acf837360a6

          SHA512

          162c51631007ab9549cb6868654d0f62c91d0e2711c0f744d5cebd06d52f34aa4ac0088d5cf2322566df7e29b4f610b93ad5b6dcf8090116b2657ac81045038f

          Download Submit

        • C:\Windows\SysWOW64\tmnstkfkepzxy.exe
          Filesize

          97KB

          MD5

          a0f177221af94bc8256a874db7470127

          SHA1

          d3e64a65c5dcc1171875a0f019e2a143c8604276

          SHA256

          b340d2a2391f6634b7d3623dc808c445d48f2a9a19f43630102e91fea755592a

          SHA512

          6409e48714ebdb286d5c8b6c7cf64180c14fe0788d5ee98108851fc3cd5f3eab2fc11a6f78197b204759c68160e76299ded3d363bd2b9c0b2b9af80b61e9c3c6

          Download Submit

        • C:\Windows\SysWOW64\xeafrgyvfgxxkqe.exe
          Filesize

          382KB

          MD5

          badd716c7c48a8241873d9251da496d1

          SHA1

          6bd2a072c8f64a1780fe75d983cb7b6584985c6d

          SHA256

          ad4373bfa026f66380b8ce44d6bc300d146770114fb10087019af7c616dc11d7

          SHA512

          7bf3f09216e2ba376053e668963797cd78f91119467917a84f467dd3110d6bd26592784cdf7cefd293413ff5b6dbe10a996d89627177235d9f109732c05f36c5

          Download Submit

        • C:\Windows\SysWOW64\xeafrgyvfgxxkqe.exe
          Filesize

          101KB

          MD5

          0b6655a92648fb3c6324ccb973de6d39

          SHA1

          bb527ae6b025cdbaa90a8e94975d16dd735af097

          SHA256

          460083c2a35b94a23467ba9db46aec04f77e1a5b40962fc3b07864001f9f8e4f

          SHA512

          b5d9c4931d53f7499ceeaed673e2f1b7e2597d14e71632fc5a0a418c621dffb5e916741437a85fa94bb66f1106e21eee4eaf0a4d305d4a66255c3c1061ab9290

          Download Submit

        • C:\Windows\SysWOW64\xeafrgyvfgxxkqe.exe
          Filesize

          512KB

          MD5

          71000233bda938c3fb4288961fe9bf55

          SHA1

          851b723804679bb74010bf523017ef7d8ee1ea76

          SHA256

          e7a1226942aeaffc24b36dfb4ee9073da78d1a763317d8def3d6ccdda7c3534d

          SHA512

          23d131e94bd5e6fbcbdb28bc8076c06eaaedda73e5aaaf0e4522215a158f94f304fd6004aee667a2d54518bde559bd424e68d0492f197ed90ec3ee86fb01d0d4

          Download Submit

        • C:\Windows\SysWOW64\ygwfnhac.exe
          Filesize

          512KB

          MD5

          25adc8722d4d7db7fa04ff8759a58a35

          SHA1

          96a7dd619969e6b17b575a6ba0cff99454ea6c39

          SHA256

          c36823f941ef8159251a52d3aee4eb0fce73cabcac938edfe7834b296d0144fa

          SHA512

          c26d099d3299d905833f96e53715f3607063e1ceb2ddfb9954932520ed249afb9c6e6be0d2086546918b0db1db7e8595b9d1441f5c54918824f7064e67cee4ef

          Download Submit

        • C:\Windows\SysWOW64\ygwfnhac.exe
          Filesize

          95KB

          MD5

          325d35d16810bf2ca20f49e9369ceafc

          SHA1

          16a818972ea75b6656eba8b6ca090be9e0bc8f03

          SHA256

          8798efdb1d409d30daf09e596ff0a6875f2f9b89e08c16e891206ddf0771a645

          SHA512

          a0664efd0a950150ffa3b7f79d76038579f20835e4b99043db61586a475ca9f06f1907b7cbdc46e36feb556a8d4cbf473a7f8a5aa51872a41b997c8904284893

          Download Submit

        • memory/2488-38-0x00007FFD8A8F0000-0x00007FFD8A900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-129-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-46-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-45-0x00007FFD8A8F0000-0x00007FFD8A900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-48-0x00007FFD88470000-0x00007FFD88480000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-49-0x00007FFD88470000-0x00007FFD88480000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-41-0x00007FFD8A8F0000-0x00007FFD8A900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-123-0x00007FFD8A8F0000-0x00007FFD8A900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-35-0x00007FFD8A8F0000-0x00007FFD8A900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-36-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-39-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-42-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-43-0x00007FFD8A8F0000-0x00007FFD8A900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-44-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-101-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-102-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-103-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-126-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-130-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-47-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-128-0x00007FFDCA870000-0x00007FFDCAA65000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2488-127-0x00007FFD8A8F0000-0x00007FFD8A900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-125-0x00007FFD8A8F0000-0x00007FFD8A900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2488-124-0x00007FFD8A8F0000-0x00007FFD8A900000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3332-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download