Overview

overview

10

Static

static

5

49835cd073...2b.exe

windows7-x64

10

49835cd073...2b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    49835cd07387458f9a8b1d1cbc5be92b.exe

  • Size

    512KB

  • MD5

    49835cd07387458f9a8b1d1cbc5be92b

  • SHA1

    b0945ceb63cdac77834e7a22d0e6e832df976c2f

  • SHA256

    9fafc0c895dd9794412faa1191967076ab15c60b5dd1567d7ac4c502f413de96

  • SHA512

    b9ed7e19389539536bb166f2294e3bfda9391ad85288a3590c22a1cbea1c795c8ebc3e51dbfaaa3f0bf3c5e9bf453690fff40a47eda84cf5ae467a8eab2b3dcb

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49835cd07387458f9a8b1d1cbc5be92b.exe
    "C:\Users\Admin\AppData\Local\Temp\49835cd07387458f9a8b1d1cbc5be92b.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\SysWOW64\krnuqurpulvczua.exe
      krnuqurpulvczua.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2728
    • C:\Windows\SysWOW64\weshpwvvenrdn.exe
      weshpwvvenrdn.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2860
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1932
      • C:\Windows\SysWOW64\qaqqroah.exe
        qaqqroah.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2744
      • C:\Windows\SysWOW64\eunsjhvegw.exe
        eunsjhvegw.exe
        2⤵
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2828
    • C:\Windows\SysWOW64\qaqqroah.exe
      C:\Windows\system32\qaqqroah.exe
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2580

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            b780ce7e97ffc77f54b564480c03be4b

            SHA1

            e03f948f6d8d5633e7407e9d1c90b947d1df4d62

            SHA256

            3b3ed3939d707dca024a45aa795ed09bb4228300dbd4f6635e7906e329af4083

            SHA512

            feb8183247d64e1d297fa3c1a801bbfd698d1e3ba432c2f7e0a9c2b031c9449b34e1eb9ca4ab2e8fe0b1586b04e6ff2cff064b0028d7976e37e33aa65b9f16bc

            Download Submit

          • C:\Windows\SysWOW64\krnuqurpulvczua.exe
            Filesize

            512KB

            MD5

            979655dd9fb6b9bd665fa6dab6cbcc9c

            SHA1

            66982a45e6455a5e30c0740a507328c51ba60bcb

            SHA256

            a63c15a9b4c5756f81a3638aaff6601fa45fc91ca2090e2b686c44f27f697bb9

            SHA512

            f0a8060aeeddec36a4989a0115a75e0f5859e7bf638b7ecda827bfecfc637be900132a4712247cc86da3d9dcc7a54e6cabc1ff59bc86a0d1afef24f73bc969c9

            Download Submit

          • C:\Windows\SysWOW64\qaqqroah.exe
            Filesize

            512KB

            MD5

            e63be3f65a0d6e6ce9193959bfb72057

            SHA1

            d5d600463b8d9ce0707519cb71806a89d6ff7043

            SHA256

            d510eb72b1ab629ade09cf2720159b0bbc112519c18b72206ed38057a02cc995

            SHA512

            f44c4ebdf3817f5e4248b7d5ea187dda5b9e5cc93b198b182acfee2065be11a662b005e8af05c719170f1e7d8cf6a2d2ec6e1de1a767b457b899b07a5955daa5

            Download Submit

          • C:\Windows\SysWOW64\qaqqroah.exe
            Filesize

            104KB

            MD5

            e434af8a9adb1818fcc775453315d253

            SHA1

            9c723a819a3ae37e9c88615a0b98067d82dbfb00

            SHA256

            f318dac03557154aa948ca2cf121b5ad65afcbab97846c485e98daf8ca1aa966

            SHA512

            b8e66e47595b290f6bd7c8bab2fb7f77db801554daa6199763d735673c7e6fa8ecf99b33147fd6b684260fad3d4a41ca622806f1732d97b973e693751410c919

            Download Submit

          • C:\Windows\SysWOW64\weshpwvvenrdn.exe
            Filesize

            327KB

            MD5

            339df21338ccfacc02320e455149296b

            SHA1

            a51da3314313176fcfa51714c5a76857aaa657a2

            SHA256

            6aba9195df62516882d1edac85ce66accef1b48a97f98f980b9d086a7d65baf2

            SHA512

            c1fcb4e0cfe4d0be3b6ab257c589222926cc2ec334b292ba88724c430a5d6c169bb9a5a04472fd2a03ae6123e1a56a5e00070d1738703c1ec1db06d26074ab3a

            Download Submit

          • C:\Windows\SysWOW64\weshpwvvenrdn.exe
            Filesize

            413KB

            MD5

            32ebe632698c34115cf4fde2fd26a005

            SHA1

            c86f851ed4702ab1f9b7ecd2de33a3e5bed43cde

            SHA256

            6914003d74626f905a9ee70fe0e84999196aa047576814767321b2fe35ffc490

            SHA512

            cd7584948ddf8c9195ae516a828e0f93a6e149a412e86bb55085cb1fd6f8ad16242e2fbcea6b28a8bc4a09f3db528832aa27c61a1f2648a6aa13f135a8779125

            Download Submit

          • \Windows\SysWOW64\eunsjhvegw.exe
            Filesize

            512KB

            MD5

            415cfd842842124ad1f449e4abb7d6d4

            SHA1

            cf69c77a0c34b64498ce2254bc54bb62fc81b7bd

            SHA256

            27b75ccb5fd4a5937eaaf8b2e206474f93175021c4c15fbebeee8c3a28b165d5

            SHA512

            be302e996b93a7a96eb72338567431247c182671beef39f8b2acc76138d9856279da813b833e29fbf7d90b897b1466b7bd60be2eb64b57260e95313bb1935d74

            Download Submit

          • \Windows\SysWOW64\qaqqroah.exe
            Filesize

            108KB

            MD5

            15fdaa5355f7e1f570fe391de9e5450d

            SHA1

            9769d25970341d1419d6f2cc262780512d26210e

            SHA256

            e3481e21baa08c162e0832beece51eab10ce59414926ca0aae7be5729314278a

            SHA512

            9b375502fa6c353d71c2bd2a6aa71341de3b12bbee254de6d1f5467e694a14c7cd82086fd64656096c4f54fe69181a6fdd73a6092ca81d0c9da561007325302d

            Download Submit

          • \Windows\SysWOW64\weshpwvvenrdn.exe
            Filesize

            320KB

            MD5

            40eccbf82b7b8fc916befc4f91646a41

            SHA1

            9b26728b4c732bfeb504f70ab523d90def972d37

            SHA256

            1dc118e41bf637830be03d9bfe6d57960cf8dc9dbe9c8302a78e3406285bbaaa

            SHA512

            4714d4a188098bfac7feb042ef4c6f0236e826c335c740df7f47d60f0e70d50c5eeaf73e1b94afb0408bd8c6b5ef6fa9d49577a6ac214ce115f4b6db0b341cdf

            Download Submit

          • memory/1752-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2704-45-0x000000002F051000-0x000000002F052000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2704-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2704-47-0x000000007124D000-0x0000000071258000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2704-80-0x000000007124D000-0x0000000071258000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2704-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download