Overview

overview

10

Static

static

5

4e8c825cbe...c6.exe

windows7-x64

10

4e8c825cbe...c6.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    133s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2024, 18:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4e8c825cbe6b39f45da640bb381ac8c6.exe

  • Size

    512KB

  • MD5

    4e8c825cbe6b39f45da640bb381ac8c6

  • SHA1

    a06695df4cfd5614a371c2f7742ff64b885dde53

  • SHA256

    7b7fb98a1d53bc8a4f67c610c941de1ad0467ecdc601cb426972d987d03f370c

  • SHA512

    6220e5451077f9655384829fdadda087d59f7aae61656d8abaa10c461e8e2ffbc9747491ccfeee5c159ae13124bec00b666797186b7d726ebcd8ae47302779a4

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e8c825cbe6b39f45da640bb381ac8c6.exe
    "C:\Users\Admin\AppData\Local\Temp\4e8c825cbe6b39f45da640bb381ac8c6.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Windows\SysWOW64\savzxkfzer.exe
      savzxkfzer.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\SysWOW64\lwdfyoln.exe
        C:\Windows\system32\lwdfyoln.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2616
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2156
    • C:\Windows\SysWOW64\fgmvvkiuovxmv.exe
      fgmvvkiuovxmv.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2640
    • C:\Windows\SysWOW64\lwdfyoln.exe
      lwdfyoln.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2812
    • C:\Windows\SysWOW64\gihgfrqrdlbqmif.exe
      gihgfrqrdlbqmif.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2816
  • C:\Windows\SysWOW64\fgmvvkiuovxmv.exe
    fgmvvkiuovxmv.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2236
  • C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c fgmvvkiuovxmv.exe
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3008
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\gihgfrqrdlbqmif.exe
    Filesize

    384KB

    MD5

    0e151ec3919b72f9a6c7fe60d10f4ea0

    SHA1

    91fb01badc6db9808233ff95abf39c37982a8c85

    SHA256

    f644299fe8f10c5f3e24c1943fc808270b5d4f853e2316abf091c8d18344193c

    SHA512

    41d25f82ce04a14c21d19a9ad2d12663714221b6ecb1c3ee579a4a134949de0bfb3e6212e9acf97d0659d50e7a034dcdc103ecbedd8a71fbfefdc30f5728c12b

    Download Submit

  • C:\Windows\SysWOW64\gihgfrqrdlbqmif.exe
    Filesize

    381KB

    MD5

    30aec9e0b33fbd99234328357879f812

    SHA1

    3c9d37139d4ccfe2b694afba9633170d0f510a92

    SHA256

    15aad0daaaeea2f1eb8d19a8999f42844b2885d6bef949f6787feba7dad46563

    SHA512

    2060f2cc8c90181dd0a9965f0ff3a94aece08c82c4a68454846f66778bc60dade3ba5ddc38be57311ff4a7bd78217b89a9cd09837eee4b5d9893277299dad415

    Download Submit

  • C:\Windows\SysWOW64\gihgfrqrdlbqmif.exe
    Filesize

    512KB

    MD5

    52c48e377b00288c74d36eba10b07ddf

    SHA1

    fd568d7a8450cb30d2db00c960de2e02269342b5

    SHA256

    ed5266fcddd0a043d6b5c4b95f95f59ed942772455145b6c80f07cf28bc9f85e

    SHA512

    00b638506e90574a540d5eea19ae632e314232158a66d43ecae9dcbd3e33c03ecbe364dfc97cde58e5298046736d3ce86127b2e115a1aec2643941bdce9490f7

    Download Submit

  • C:\Windows\SysWOW64\lwdfyoln.exe
    Filesize

    95KB

    MD5

    325d35d16810bf2ca20f49e9369ceafc

    SHA1

    16a818972ea75b6656eba8b6ca090be9e0bc8f03

    SHA256

    8798efdb1d409d30daf09e596ff0a6875f2f9b89e08c16e891206ddf0771a645

    SHA512

    a0664efd0a950150ffa3b7f79d76038579f20835e4b99043db61586a475ca9f06f1907b7cbdc46e36feb556a8d4cbf473a7f8a5aa51872a41b997c8904284893

    Download Submit

  • C:\Windows\SysWOW64\lwdfyoln.exe
    Filesize

    92KB

    MD5

    6662b185f19fbf697c56a25c92de7961

    SHA1

    0df0c0df0de3724258df2549c583e3c934aca726

    SHA256

    c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

    SHA512

    c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

    Download Submit

  • \Windows\SysWOW64\lwdfyoln.exe
    Filesize

    512KB

    MD5

    5a08870f63c097e693f07e104b3b922c

    SHA1

    480d9a5077932bfdd5f56a1c3540abc1fad4a415

    SHA256

    8c7df3f47b9ad964222cf6ef0abd6bf88591e2892c60d427a5638a4e6c057a6f

    SHA512

    ff40ea80b828dafe8cb57482b61241b108b8754d2e1e72f7e83c3545382bc942cb5672ecc789cea5143cc23b3f1a5c6582b87cbd9e7d24e67ca569b8563b6169

    Download Submit

  • \Windows\SysWOW64\savzxkfzer.exe
    Filesize

    512KB

    MD5

    042a96a26207a795bac5ea21a06ff14e

    SHA1

    25202f6c6453d79aa0c526e10535c20536eadf5a

    SHA256

    34d6964e9345dd0ee4ceb815f6b12c1a8a5ca5243d8d9b7a53b9c9052597561f

    SHA512

    5c3e9e79a56a1cf60803e09ea2b1338d0ae30657e04434d3c357f568d960ccc3137e61b144f3d2d37203bdb6dda9db678ee3aed189f0366e1312c51a77f425b5

    Download Submit

  • memory/2008-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2156-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2156-48-0x0000000070D4D000-0x0000000070D58000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2156-46-0x000000002FA91000-0x000000002FA92000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2156-83-0x0000000070D4D000-0x0000000070D58000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2864-82-0x00000000047E0000-0x00000000047E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2864-84-0x00000000047E0000-0x00000000047E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2864-90-0x0000000002A70000-0x0000000002A80000-memory.dmp

    Filesize

    64KB

    Download