Overview

overview

10

Static

static

5

39b39bffaa...e5.exe

windows7-x64

10

39b39bffaa...e5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 14:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    39b39bffaa716ed0d4db3521b341f6e5.exe

  • Size

    512KB

  • MD5

    39b39bffaa716ed0d4db3521b341f6e5

  • SHA1

    a507f60017cdecb4201efdf6e9f246245c3e87b4

  • SHA256

    fcde603149bf265e0a794ef819dbd06769e5ec5c7b2af796da77113ecdc6a4ea

  • SHA512

    5e26143ccf7ca1ec5d0c4a5880739f78059e30f33878ef8716da3725c8a1f7adcf36d9c4b53f2f1852ac5c0814eeebbd2f57a5cb3d52e79030d6d4a909a9cda1

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39b39bffaa716ed0d4db3521b341f6e5.exe
    "C:\Users\Admin\AppData\Local\Temp\39b39bffaa716ed0d4db3521b341f6e5.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\SysWOW64\cqoeggpill.exe
      cqoeggpill.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Windows\SysWOW64\dmufiobg.exe
        C:\Windows\system32\dmufiobg.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2676
    • C:\Windows\SysWOW64\nnshviamzixqutj.exe
      nnshviamzixqutj.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2132
    • C:\Windows\SysWOW64\dmufiobg.exe
      dmufiobg.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2752
    • C:\Windows\SysWOW64\btesymqdisbjj.exe
      btesymqdisbjj.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2960
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1204

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            cab3025770154bbbd85a528d06f489d3

            SHA1

            5b8db0e6da9e1c66056fcc8bd5b46b690c07b0f8

            SHA256

            1811bcce0a51b4135736f6eeac83e75394cf307d739d8a300b0575c0bde26bb4

            SHA512

            1eaadb43dfa15c4ec0c324f697a17ed7048021bd29c8077e5281089d66837c8183ff596771fa24cc1ff5d93cd43bc2698a8fb349cc17d5f9dcd049886614c7bc

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            635d680d80e479dfec0f10f662cfac0f

            SHA1

            7ee6883e0f895ec63476a16722784d9af5066742

            SHA256

            a1b90cf73a908e3c4a7125187979d7ebfa834a91c6373eba0609597ff22b4cb9

            SHA512

            deda575b30ce106529f2e26a4a123126dd404b9fbe06bdea218fcba14d72a3a464371c2fc3ed6d30e24b5369dc766fea05d2907ea031b88eddb1cc797d2294f8

            Download Submit

          • C:\Users\Admin\Documents\StopImport.doc.exe
            Filesize

            512KB

            MD5

            076502190a5164febd8cfd7aee303479

            SHA1

            82030f38b1fa7fc8b42e35afdd3ec77c55b887bc

            SHA256

            2c57212875bc95331659bf269d8f4bb1e7d9437a7913d55b571723e343616496

            SHA512

            1b99675d708b8010b4ace44753329bf2a8e25ac79a5a63a465028298c8e9599873d3a900af220b2f278fc3084712b8b832a0fbfe46abfa7ec91b31b8cf5d9bd2

            Download Submit

          • C:\Windows\SysWOW64\nnshviamzixqutj.exe
            Filesize

            512KB

            MD5

            b247be90c75e92eee8e1b7ff38ef88d8

            SHA1

            d1c83b5f6bd819aec1adc1749028fb123eff0a37

            SHA256

            f22791a135ce9357c69ed1f580785ad2d21ca2b9c469f185f1726735f7e45c6c

            SHA512

            d5172acde70e842ec31c5b4019c0e4b93e8e88fd23e4eee4f020187f4c8f85d40423b3cedc27aa45de7bf62f66be8f231281da6b57ffe2bfdee616a2fd730ca6

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\btesymqdisbjj.exe
            Filesize

            512KB

            MD5

            e6e41ac1a9459bc5d2a4246e61408d0a

            SHA1

            3b2511174bbf6642d0c1bad3a3aa4b6e8d2832e2

            SHA256

            73daa2d438a90ad5f9b2dd7e67d58fd5ef321131091e1ff4525095e4faf6cec5

            SHA512

            9067592cf67d72b5b224b34d804cd8b7de53478e8383e7ed7091a81781c2363bde62a5fef0a56895a65cef75fdbf373c3721c7c0f63ef7da4d9768dfa57c037a

            Download Submit

          • \Windows\SysWOW64\cqoeggpill.exe
            Filesize

            512KB

            MD5

            b5573e2842b943ca411329a999d56de9

            SHA1

            8ef963ecf0034b0f71c652079e002957431f0adc

            SHA256

            730ca5593a911935d1cd19dcbd57bf55d42b1f662e39eb3079b09f6c9ead9957

            SHA512

            21cf8553409dd78618257d868589628717232ef4dd601bdd9109167d52cf64470bf7086705caa4cbc824943202b9d925bf12a82dcc4e99c316072896c052b6d0

            Download Submit

          • \Windows\SysWOW64\dmufiobg.exe
            Filesize

            512KB

            MD5

            3ac949ce1dfcfade8a2757b880061497

            SHA1

            26f9e791740db3c8154c03e80f62cb8bc50dfc74

            SHA256

            1132e54238cb2219e13babe8d362e386f67a17c17c8a98f19098c0ac907da907

            SHA512

            5b07d464a779f70a812674c076fee8257e338474268d4680fdde302c2a9b60a4edc75fc0bc30d74a1e177079e976c0818d0bd46b48a39e66f6781d4bae4218bd

            Download Submit

          • memory/2644-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2896-47-0x00000000713CD000-0x00000000713D8000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2896-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2896-45-0x000000002FE11000-0x000000002FE12000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2896-80-0x00000000713CD000-0x00000000713D8000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2896-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download