Analysis

  • max time kernel
    139s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:20

General

  • Target

    ab6b87a8ef210e5c047f565cd76a0a1f.exe

  • Size

    512KB

  • MD5

    ab6b87a8ef210e5c047f565cd76a0a1f

  • SHA1

    a760eecc424853e684a357082d1aca3302f579a7

  • SHA256

    1474f25f1f927dcea56a12f600530547de3fa6a226474b3459425ec4145bb226

  • SHA512

    21899007f1fa298fc7688f51693662c2e3f01dc5d5ce96a3cee4bb3850c4d72c14d2c48f51fb04b4cf7f82828f6afd1d92e362decf0eeabf19abadc3b42f854f

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe
    "C:\Users\Admin\AppData\Local\Temp\ab6b87a8ef210e5c047f565cd76a0a1f.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Windows\SysWOW64\bqqqdbgszb.exe
      bqqqdbgszb.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4336
      • C:\Windows\SysWOW64\luyvtbfq.exe
        C:\Windows\system32\luyvtbfq.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3248
    • C:\Windows\SysWOW64\dtwdosdnwumspcd.exe
      dtwdosdnwumspcd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2100
    • C:\Windows\SysWOW64\pdqdblefhnggz.exe
      pdqdblefhnggz.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4532
    • C:\Windows\SysWOW64\luyvtbfq.exe
      luyvtbfq.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3688
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4528

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\bqqqdbgszb.exe

          Filesize

          512KB

          MD5

          5421cb1cbba708b4ea0c07a64e19ffed

          SHA1

          9667419b526c83905b2456a5cc3b17cb320ba48c

          SHA256

          d3ff18b4c4808393aaed293e30733cb03eab694e34439d82e77b5cc9e9c16cad

          SHA512

          f89a18405de14bb7d0da267798935e952f29d6161e007c7f298976e9099ab72217eeca283032818d8cf764efe4bc1c9e86c722b1c192e5050fff5e1f8e1d075d

        • C:\Windows\SysWOW64\bqqqdbgszb.exe

          Filesize

          512KB

          MD5

          90adb29ed44b7a78fb717cbebe59c447

          SHA1

          4da5d9617555a7956b328e29a6ad52619ee66db5

          SHA256

          5dadf9f84aa031a75afc962530ac3f15ad6144f2cfeed16a9f12ea242dce7510

          SHA512

          67c8f31bcb531b8766f39cf6e540095b0b8a2aa00c7c99735b6cf1742864a61216a06b565c6e216d4ffdaa95d71a58234bfca18eb50b0473af3e20d1e1bcdf15

        • C:\Windows\SysWOW64\dtwdosdnwumspcd.exe

          Filesize

          512KB

          MD5

          6d368801e62ecca9f0ff6d5a5e9fdaca

          SHA1

          515ce20e43d63b12cb444e362364b2476f7d7ee9

          SHA256

          b6a5f6bc7cf97c58014477074e19c840834510e99ee90e6bfba0036c4bafcd6d

          SHA512

          6cfbde5142b16130d79a021ab028dd9f023e772c68b876fb3771932c6bc8baf6e0bbdd8a9b4fa6c72fa777126a70dfdca3cae2864d6e107a4f45c0a38934722b

        • C:\Windows\SysWOW64\luyvtbfq.exe

          Filesize

          99KB

          MD5

          7fc6cf931da79ecd4267f22c6a1aefa8

          SHA1

          913682b9a75a4089cc18ec25b28e082916a6b314

          SHA256

          2672445b36639d26c7bcf277704d7f634ea7a6f4eac634027b98fb3f94062487

          SHA512

          272947751145ba29cbfecc6fe73cf5e20cf017c8c436a8af45198499e8b34c5f70215c3d5f21676a2a5de87616e85aa12b5cf0e263d57042e4221f7e12d81eaf

        • C:\Windows\SysWOW64\luyvtbfq.exe

          Filesize

          512KB

          MD5

          36cabac8345833fed9bb7944e6ff00fa

          SHA1

          095f58f00addb206ab2b4677a6049f36e97f41d4

          SHA256

          be1e525d3dc765f89d0a9ef33457ac54e28fb415d0bcde4fdd8167e995774a01

          SHA512

          fca8d2f5aee1064e97c5ae34e6384bee92cca2dfde5d6c5bc3e526eb5aef4b50f136446ca90a6a74c2fba5fc0baac4b520827c7b6789871bfd57f1b283c4a371

        • C:\Windows\SysWOW64\pdqdblefhnggz.exe

          Filesize

          512KB

          MD5

          06da1727b90a5c016f16a3548a016c63

          SHA1

          a497c1fbcf0f71785a9be2cfc89e647e570d5cdf

          SHA256

          9f63f7848636a989c149712e0e4b15ae1190508edb89c50425391d774e16953c

          SHA512

          32c35e2c44c6b12e713b7de72465a4f18506d8c7b13a487cfab3a0990eae355df17c0e8990ca842cd156f7a31b850aaf1c401b2a2c97ad8db0ee677ab6b709bc

        • memory/3828-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

        • memory/4528-53-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-47-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-45-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-49-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-52-0x00007FFAAA0E0000-0x00007FFAAA0F0000-memory.dmp

          Filesize

          64KB

        • memory/4528-54-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-56-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-58-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-59-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-57-0x00007FFAAA0E0000-0x00007FFAAA0F0000-memory.dmp

          Filesize

          64KB

        • memory/4528-55-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-38-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-51-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-50-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-48-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-39-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

          Filesize

          64KB

        • memory/4528-46-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-44-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

          Filesize

          64KB

        • memory/4528-43-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-42-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

          Filesize

          64KB

        • memory/4528-41-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-40-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

          Filesize

          64KB

        • memory/4528-35-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

          Filesize

          64KB

        • memory/4528-118-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-119-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-120-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-147-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-146-0x00007FFAEC970000-0x00007FFAECB65000-memory.dmp

          Filesize

          2.0MB

        • memory/4528-145-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

          Filesize

          64KB

        • memory/4528-144-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

          Filesize

          64KB

        • memory/4528-143-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

          Filesize

          64KB

        • memory/4528-142-0x00007FFAAC9F0000-0x00007FFAACA00000-memory.dmp

          Filesize

          64KB