75e769c58ba3d86011dce06c2fbc1687d705753048a2c3e90e6c47cafc5c7cf2

Analysis

max time kernel
5s
max time network
138s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b2d3bff999fe2b167af548843332643.exe
Size

51KB
MD5

4b2d3bff999fe2b167af548843332643
SHA1

ea46a64d6a715d7d7d1b6751b88d612337aadaed
SHA256

75e769c58ba3d86011dce06c2fbc1687d705753048a2c3e90e6c47cafc5c7cf2
SHA512

33857794f1771abf2ded4d6700360b3963d085a6fce2ad28fdac3c752546641efcee4cceb23031e5d6bd98760ecc860da5d321a0cbefabf43d2489a94ec61986
SSDEEP

1536:9WMY6ILkV8Hmuh5VYROO7Yg3gmeaWi1WBGUu:9W96IcqJ3YRq5aWaWBA

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\lbnore\Parameters\ServiceDll = "%SystemRoot%\\System32\\lbnore.dll"	4b2d3bff999fe2b167af548843332643.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\lbnore\Parameters\ServiceDll = "%SystemRoot%\\System32\\lbnore.dll"	4b2d3bff999fe2b167af548843332643.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\lbnore\Parameters\ServiceDll = "%SystemRoot%\\System32\\lbnore.dll"	4b2d3bff999fe2b167af548843332643.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\lbnore\Parameters\ServiceDll = "%SystemRoot%\\System32\\lbnore.dll"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\lbnore\Parameters\ServiceDll = "%SystemRoot%\\System32\\lbnore.dll"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\lbnore\Parameters\ServiceDll = "%SystemRoot%\\System32\\lbnore.dll"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2140	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1936	4b2d3bff999fe2b167af548843332643.exe
2140	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lbnore.dll	4b2d3bff999fe2b167af548843332643.exe

C:\Users\Admin\AppData\Local\Temp\4b2d3bff999fe2b167af548843332643.exe
"C:\Users\Admin\AppData\Local\Temp\4b2d3bff999fe2b167af548843332643.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:1936

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k lbnore
1⤵
- Sets DLL path for service in the registry
- Deletes itself
- Loads dropped DLL
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\lbnore.dll

Filesize
8KB

MD5
8f3de6d2e0a3b7fcad20fa4f10fc051c

SHA1
afbc297b4476c7d9db51ab4f4fa191976cedc1eb

SHA256
52f9a9b0ec215ce01cae838827b077540e3e6271cf35f6e92bac2fb4f7da1ac9

SHA512
b1c6d8607b10148db08503b0f8d38cb97877fc3422ceddec52538aaf2999399360d947f84a5d115c4b1f7eb060d0f9abfdb6e86098d39d1c2f8a171fe0a089f8

Download Submit
\Windows\SysWOW64\lbnore.dll

Filesize
7KB

MD5
cb0c10b7d03874b0212303a61c123960

SHA1
fe084c9d94ebab565d8da9d0ee4fe5589ed21ed9

SHA256
16fbc659658cbe3aeae9f48b23dd1cc445fd65ea87a95cad51ee2ff1737095c1

SHA512
73a25cd75214e2d72fb284963ee39d85c009afd6039aa1a46cc36c6349bedec6ecde5269d7d4292e3e6cc263aa0c1ba73f0b023475eb2e9c225bbb00794fafb5

Download Submit
\Windows\SysWOW64\lbnore.dll

Filesize
18KB

MD5
8795bb6a9bab00942afab43536245b6c

SHA1
1ee23c568d16796c5346f352eaccc67986ee08a6

SHA256
cdc2110032b79f677d26c2d34eca4871ec7bd991be466d372cfb6db91637eef9

SHA512
0908b556883f9070538d0b2b6e68e6950819dded070e0ee098022d67d78eb15285416ba7f6b2fdeb8885c93d9bfd798747aaaca199acfda6dd553d7c1b1b2994

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads