Overview

overview

10

Static

static

5

5497b35568...dc.exe

windows7-x64

10

5497b35568...dc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2024, 21:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5497b35568529d7d1a1b352dd947e9dc.exe

  • Size

    512KB

  • MD5

    5497b35568529d7d1a1b352dd947e9dc

  • SHA1

    939802285c3a1cfd5b9dc68dd0e9e15fef226a73

  • SHA256

    953174533c940387736d75bb4d02d9bf760502fbfa999c1da1f3e7a01f22896a

  • SHA512

    1aded16667f9b9110080af065221a6d37c571e131515651b743203ccd83154788c1cbedf5e0225fded34f1c778e1ec27137ee76f68dfa1f26967173ed578db02

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5497b35568529d7d1a1b352dd947e9dc.exe
    "C:\Users\Admin\AppData\Local\Temp\5497b35568529d7d1a1b352dd947e9dc.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\SysWOW64\jlmwxkktzz.exe
      jlmwxkktzz.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\SysWOW64\flkltatq.exe
        C:\Windows\system32\flkltatq.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2732
    • C:\Windows\SysWOW64\gzwjouefgigmoyv.exe
      gzwjouefgigmoyv.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1748
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2636
      • C:\Windows\SysWOW64\pvygagzmidhnv.exe
        pvygagzmidhnv.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2716
      • C:\Windows\SysWOW64\flkltatq.exe
        flkltatq.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2608

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      302d9f841a966c3b34ddd99a8d4546f0

      SHA1

      ac8d451c1e7a7600adfa6534d9331381b4d07266

      SHA256

      2f37fdde65fe80de50c8a6298d8d4ca97a3ff45009fa9e8c719a425283bec0af

      SHA512

      bbafc1bfa8c4ca7de6a0c7edc3896f13e569a277d21431c7d29019cb9b20aa144b4b0f9015f676f729b630fec9f3b54f8ac2e815126367fc1fe56308852eb285

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      9e916fe2cd320b5df78a22dad1f66b73

      SHA1

      51cf719cabcaba4ee2e8c4901d654ae3fc6b784f

      SHA256

      70f26044cebf2c0aee77ccda1306a44202b98a8ca4a0de23ce54b267a419d59b

      SHA512

      270e785728f2d4775fb3f177493fe4f758708afa019d534284b89c92608d4b6bd7e0958db0a14a480539a34148768d0bcb54ec134c19b6a08c7e7f5c92632a66

      Download Submit

    • C:\Windows\SysWOW64\flkltatq.exe
      Filesize

      512KB

      MD5

      9c185fab00f2c94aed63bc1670ff0fdb

      SHA1

      c64e04edb65cfa6803e23f187d1541c940a899d7

      SHA256

      a29432537e30b4d40a790c66451be8fd6bf361a73d085bd8fa85b66cf76a61ec

      SHA512

      c889cf6af6db30b810294227d3de3b2bc9b236bccfe471eb2c7476be3c8ff43abbeea7a0bf0baaea004b84f27f33fcf8506f80ebd7870a30e50d1de1451f608b

      Download Submit

    • C:\Windows\SysWOW64\flkltatq.exe
      Filesize

      470KB

      MD5

      5b1c1a81593b10e33d5b1b11ea1686e4

      SHA1

      d4d3122886e35a7ad8ccf8785a9a4c8483f54cfc

      SHA256

      d3932b41cf24b7e0c950d131e6b11386482240d4b00ddac369479b6dc73e08a1

      SHA512

      c923806be96fde2a880f30ba8fcc63ed264dad071b467a6969ded0512cd53dc8555d23b5f1bb2b042855a3056725b210882d277dfcb3e7fa8386d8b9d82fc067

      Download Submit

    • C:\Windows\SysWOW64\gzwjouefgigmoyv.exe
      Filesize

      512KB

      MD5

      e535bc9999dc3e1eea09f3c6710020a7

      SHA1

      ecc0ad7f70d7e1faaa72f179e7cac1eabd1f20e1

      SHA256

      6b54d1171b40496d9fdea585567259dfe8a9b2814e0fe2550d12d20758b0d43a

      SHA512

      259931693ac9ff00340fdbc5745f3f6bf9edd23a0115d58d71c6fdcb9e252a14da7ca207010497af39befb1d521eea6bd4decd413ba12b561c67585553ec2452

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\jlmwxkktzz.exe
      Filesize

      512KB

      MD5

      f333223a7324f92a17850133101a2e48

      SHA1

      2b08bca7ef333e1a6efcc263006b1954852cf82d

      SHA256

      f1f8625a286254cd80965c1ddb7246b7c5f221dc535aca4f997e5f9560fdee08

      SHA512

      ec1c99312f5b7da831ae4adcc5eb52f4c1b7b51a43e6491d200a909a49b462164c4495fe55d5182efc08e4ab8ac5e139e59f909b98d2a4dc12b2f7f779766d47

      Download Submit

    • \Windows\SysWOW64\pvygagzmidhnv.exe
      Filesize

      512KB

      MD5

      8afdf25e7de20a45309eaabffe0140e5

      SHA1

      911f7223d112acd014f82242176b213b812940f4

      SHA256

      0908178715640ea2a79b8f0008c83bc6f6d9e1a65176b668fdc4fa63cbbfda32

      SHA512

      1477ecff96d253ee5854dbf406945c4ffe47a5ad4bfd6f04b15d323d5312bbbca00494419e695c7913e533ac264da7b8408c1feec8c2463d5fda17001256de52

      Download Submit

    • memory/2088-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2688-45-0x000000002FFC1000-0x000000002FFC2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2688-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2688-47-0x0000000070F3D000-0x0000000070F48000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2688-76-0x0000000070F3D000-0x0000000070F48000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2688-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download