Analysis
- max time kernel
0s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
07/01/2024, 19:38
General
- Target a666831d63d7e13bb8d76596308db7d6.exe
- Size 512KB
- Sample240107-yctnpsdfe3
- SHA256 947142ee17bbb69b1b24f90ce034caef13fae7f4e1cd62bba7d9838c1f64a7f5
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 8 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a666831d63d7e13bb8d76596308db7d6.exe"C:\Users\Admin\AppData\Local\Temp\a666831d63d7e13bb8d76596308db7d6.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\fcabposwwhemn.exefcabposwwhemn.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
-
-
C:\Windows\SysWOW64\aatiunjk.exeaatiunjk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\mqqokrcdqkmlwot.exemqqokrcdqkmlwot.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\kdculdkhya.exekdculdkhya.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\aatiunjk.exeC:\Windows\system32\aatiunjk.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
kdculdkhya.exe
kdculdkhya.exe
mqqokrcdqkmlwot.exe
memory/1408-0-0x0000000000400000-0x0000000000496000-memory.dmp
memory/3232-53-0x00007FF9620D0000-0x00007FF9620E0000-memory.dmp
memory/3232-35-0x00007FF9642F0000-0x00007FF964300000-memory.dmp
memory/3232-51-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-50-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-49-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-47-0x00007FF9620D0000-0x00007FF9620E0000-memory.dmp
memory/3232-48-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-45-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-43-0x00007FF9642F0000-0x00007FF964300000-memory.dmp
memory/3232-40-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-39-0x00007FF9642F0000-0x00007FF964300000-memory.dmp
memory/3232-37-0x00007FF9642F0000-0x00007FF964300000-memory.dmp
memory/3232-38-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-52-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-46-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-44-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-36-0x00007FF9642F0000-0x00007FF964300000-memory.dmp
memory/3232-103-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-104-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-105-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-128-0x00007FF9642F0000-0x00007FF964300000-memory.dmp
memory/3232-129-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp
memory/3232-127-0x00007FF9642F0000-0x00007FF964300000-memory.dmp
memory/3232-126-0x00007FF9642F0000-0x00007FF964300000-memory.dmp
memory/3232-125-0x00007FF9642F0000-0x00007FF964300000-memory.dmp