Overview

overview

10

Static

static

5

4606ac894d...e9.exe

windows7-x64

10

4606ac894d...e9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/01/2024, 15:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    4606ac894da9657c311fe457556622e9.exe

  • Size

    512KB

  • MD5

    4606ac894da9657c311fe457556622e9

  • SHA1

    2bea8b70cf15ef00d4615481fd231658b5726a4c

  • SHA256

    1d28a74a7ebf34d131a32f0f3b6d6158019b51c3c0d5943ea629102473517611

  • SHA512

    48c2e95f62f948f00c353c08c197b791457edfc66be152d91b48a64716e9aee3899607569bd745523a94541b88b6230f2189ba5e528fbcb280dc678aafa30b94

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4606ac894da9657c311fe457556622e9.exe
    "C:\Users\Admin\AppData\Local\Temp\4606ac894da9657c311fe457556622e9.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\SysWOW64\lrrwseqnlb.exe
      lrrwseqnlb.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Windows\SysWOW64\eainvriv.exe
        C:\Windows\system32\eainvriv.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2792
    • C:\Windows\SysWOW64\xmthgbzbqaedsoq.exe
      xmthgbzbqaedsoq.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c mwfekdheneblh.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2864
    • C:\Windows\SysWOW64\eainvriv.exe
      eainvriv.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2720
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1952
      • C:\Windows\SysWOW64\mwfekdheneblh.exe
        mwfekdheneblh.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2812
    • C:\Windows\SysWOW64\mwfekdheneblh.exe
      mwfekdheneblh.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2228

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
            Filesize

            512KB

            MD5

            fad35f04d4848383ce725fa7b001f5a6

            SHA1

            42450e74e2d5d671c7d0cc556facd9d1fa336e06

            SHA256

            7fcf2ee37da61e1559e9a09fd338f6ac3c5ee0e7904914ec3c58ec435755de3d

            SHA512

            6c2a6fdf73c365d03c21acfbd00defa86ba36a66c0bb41c2696f37a66f9deacb3c93634a515c68ff59e5f6f617cd35b21678ab9d01a381dbd871580608291512

            Download Submit

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            384KB

            MD5

            0e151ec3919b72f9a6c7fe60d10f4ea0

            SHA1

            91fb01badc6db9808233ff95abf39c37982a8c85

            SHA256

            f644299fe8f10c5f3e24c1943fc808270b5d4f853e2316abf091c8d18344193c

            SHA512

            41d25f82ce04a14c21d19a9ad2d12663714221b6ecb1c3ee579a4a134949de0bfb3e6212e9acf97d0659d50e7a034dcdc103ecbedd8a71fbfefdc30f5728c12b

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            57a75493a7503d268ccd80c4c1692271

            SHA1

            c74fab966ef41ad8f0a31c118caf04cebca2c112

            SHA256

            f1b6ba87315fb9d34dba877ae1aa1b11d7df023c73148546562912065c87d6b8

            SHA512

            76c0b002ec09627e3a9487e91f0163026a100ba8f5b24463252478d815f84a1cc880d2484102f97f3ba3a7d2545f5ba35b0c7ae5bf339097586e53316b9fa0b9

            Download Submit

          • C:\Windows\SysWOW64\eainvriv.exe
            Filesize

            381KB

            MD5

            30aec9e0b33fbd99234328357879f812

            SHA1

            3c9d37139d4ccfe2b694afba9633170d0f510a92

            SHA256

            15aad0daaaeea2f1eb8d19a8999f42844b2885d6bef949f6787feba7dad46563

            SHA512

            2060f2cc8c90181dd0a9965f0ff3a94aece08c82c4a68454846f66778bc60dade3ba5ddc38be57311ff4a7bd78217b89a9cd09837eee4b5d9893277299dad415

            Download Submit

          • C:\Windows\SysWOW64\mwfekdheneblh.exe
            Filesize

            92KB

            MD5

            6662b185f19fbf697c56a25c92de7961

            SHA1

            0df0c0df0de3724258df2549c583e3c934aca726

            SHA256

            c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

            SHA512

            c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

            Download Submit

          • C:\Windows\SysWOW64\xmthgbzbqaedsoq.exe
            Filesize

            512KB

            MD5

            629c571c0ddf2712925443c2a45d6532

            SHA1

            7be5ab52693f609879f038bcdb9b7167df66b3f0

            SHA256

            b0132b58a52d055c390b5ced86b6d3131abcb7349f6b1a27c0960ddaf42b133a

            SHA512

            c135072340e8f5d7c7c973af8b1210ed39ba81efeb62270504fb46672a96da55b4f1c6fb50726c3158c44ac2e585fc637596b4426bb2254eb5cf18155a99b996

            Download Submit

          • \Windows\SysWOW64\eainvriv.exe
            Filesize

            512KB

            MD5

            3191d3d8336887228456d4fb1e176096

            SHA1

            2f164d12aa049817fae0ed371f842141d804b9d0

            SHA256

            adb2c3ca25efe38c724e78d0ae19ebf9fe002945447bc8af4e35a5babdb185ee

            SHA512

            4f7a4c4caac0449b60f23439239a2358d0f3fa78c2360584b63aceed2b56d92daf8d2426dd49303cf56412316da5121d2bbba15fc36909b0f9ee66936b8f313d

            Download Submit

          • \Windows\SysWOW64\lrrwseqnlb.exe
            Filesize

            512KB

            MD5

            a15fd689fde2a49181a7a817e9492197

            SHA1

            c2831d4086f30823b6e94e6b70b1c5e98a1f20e0

            SHA256

            cd006ce3d641fd5e47ae099f85e1fcdfa1c043f98fab6322e592d1a2b96cc218

            SHA512

            c50f4c1357f25cf57a90a1820ad5b6db5ee2003870170c63a0878f0ea3c9fae15f81b99d9ca923c31357340730b1d601df0e970354a0445bc762f337abcf3bd3

            Download Submit

          • \Windows\SysWOW64\mwfekdheneblh.exe
            Filesize

            512KB

            MD5

            28ecf1d0de12c154c54f73858041d2e7

            SHA1

            8cc7a32494ee87c8f7fb591e2e15f2dcf68c7044

            SHA256

            54abcd600b9ed8e9e72241df85dbbc257ec72a65d72d9537f721858b5caf09e7

            SHA512

            942540dd14e8b7db0e322b3d69530eceb95d7a1b116f8f5b96d66b62ced923dfe8a774c4cce3fab1c6f5e29b211c07d4d9b879adad8d9f1983f92dd998dec762

            Download Submit

          • memory/2680-48-0x000000002F071000-0x000000002F072000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2680-50-0x0000000070F5D000-0x0000000070F68000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2680-49-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2680-76-0x0000000070F5D000-0x0000000070F68000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2680-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2896-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download