Overview
overview
7Static
static
37b6e0e0a98...92.exe
windows7-x64
77b6e0e0a98...92.exe
windows10-2004-x64
7$TEMP/DSCT...30.dll
windows7-x64
1$TEMP/DSCT...30.dll
windows10-2004-x64
3$TEMP/DSCertEx.dll
windows7-x64
1$TEMP/DSCertEx.dll
windows10-2004-x64
1$TEMP/Mobi...32.dll
windows7-x64
1$TEMP/Mobi...32.dll
windows10-2004-x64
3$TEMP/NFil...eb.dll
windows7-x64
3$TEMP/NFil...eb.dll
windows10-2004-x64
3$TEMP/NpkiCard.dll
windows7-x64
1$TEMP/NpkiCard.dll
windows10-2004-x64
3$TEMP/SCSKAPPLink.dll
windows7-x64
1$TEMP/SCSKAPPLink.dll
windows10-2004-x64
1$TEMP/UBIK...In.exe
windows7-x64
7$TEMP/UBIK...In.exe
windows10-2004-x64
7$TEMP/UBIK...ce.exe
windows7-x64
1$TEMP/UBIK...ce.exe
windows10-2004-x64
1$TEMP/UbiKey.dll
windows7-x64
1$TEMP/UbiKey.dll
windows10-2004-x64
3$TEMP/UbiK...ll.exe
windows7-x64
1$TEMP/UbiK...ll.exe
windows10-2004-x64
1$TEMP/UbiKeyWin32.dll
windows7-x64
1$TEMP/UbiKeyWin32.dll
windows10-2004-x64
1$TEMP/Ubik...to.dll
windows7-x64
1$TEMP/Ubik...to.dll
windows10-2004-x64
1$TEMP/certadm.dll
windows7-x64
1$TEMP/certadm.dll
windows10-2004-x64
1$TEMP/certcli.dll
windows7-x64
1$TEMP/certcli.dll
windows10-2004-x64
1$TEMP/certutil.exe
windows7-x64
1$TEMP/certutil.exe
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2024 22:19
Static task
static1
Behavioral task
behavioral1
Sample
7b6e0e0a9844777fe52da9bd0a573d92.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7b6e0e0a9844777fe52da9bd0a573d92.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$TEMP/DSCToolkitV30.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$TEMP/DSCToolkitV30.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$TEMP/DSCertEx.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$TEMP/DSCertEx.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$TEMP/MobileCertWin32.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$TEMP/MobileCertWin32.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
$TEMP/NFilterOpenWeb.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$TEMP/NFilterOpenWeb.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
$TEMP/NpkiCard.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
$TEMP/NpkiCard.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
$TEMP/SCSKAPPLink.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
$TEMP/SCSKAPPLink.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
$TEMP/UBIKeyPlugIn.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
$TEMP/UBIKeyPlugIn.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
$TEMP/UBIKeyService.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
$TEMP/UBIKeyService.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
$TEMP/UbiKey.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$TEMP/UbiKey.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
$TEMP/UbiKeyUninstall.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
$TEMP/UbiKeyUninstall.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral23
Sample
$TEMP/UbiKeyWin32.dll
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
$TEMP/UbiKeyWin32.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
$TEMP/UbikeyCrypto.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
$TEMP/UbikeyCrypto.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
$TEMP/certadm.dll
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
$TEMP/certadm.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
$TEMP/certcli.dll
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
$TEMP/certcli.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
$TEMP/certutil.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
$TEMP/certutil.exe
Resource
win10v2004-20231222-en
General
-
Target
$TEMP/UbiKeyUninstall.exe
-
Size
61KB
-
MD5
596a181659a0fd78bcab66aed7a74e0b
-
SHA1
5b0c2deb56375d2bbc10fb7bf4752709848b6099
-
SHA256
22ce189f4cb33647b04bc2eda9c3341eec01d77291fa42a9670b84228d0b12dd
-
SHA512
8253605b46a0b5e3a9e41924a7e150bd5aeb77a3e6e681e40770aa0bb1eebcfa114aeb0428372f68956a52cf95aa3225a984240260723a0188ddca97cda4640a
-
SSDEEP
1536:tU7JyXlRkZ9MCAAZrMnnPZ4PdcDnh3h1g:qQDkZmbAenPuPdcDdg
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2324 UbiKeyUninstall.exe 2324 UbiKeyUninstall.exe
Processes
Network
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request203.178.17.96.in-addr.arpaIN PTRResponse203.178.17.96.in-addr.arpaIN PTRa96-17-178-203deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request203.178.17.96.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request4.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request190.178.17.96.in-addr.arpaIN PTRResponse190.178.17.96.in-addr.arpaIN PTRa96-17-178-190deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request186.178.17.96.in-addr.arpaIN PTRResponse186.178.17.96.in-addr.arpaIN PTRa96-17-178-186deploystaticakamaitechnologiescom
-
292 B 147 B 4 1
DNS Request
104.219.191.52.in-addr.arpa
DNS Request
104.219.191.52.in-addr.arpa
DNS Request
104.219.191.52.in-addr.arpa
DNS Request
104.219.191.52.in-addr.arpa
-
144 B 137 B 2 1
DNS Request
203.178.17.96.in-addr.arpa
DNS Request
203.178.17.96.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
4.159.190.20.in-addr.arpa
-
146 B 144 B 2 1
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
209.205.72.20.in-addr.arpa
DNS Request
209.205.72.20.in-addr.arpa
-
146 B 147 B 2 1
DNS Request
103.169.127.40.in-addr.arpa
DNS Request
103.169.127.40.in-addr.arpa
-
142 B 145 B 2 1
DNS Request
206.23.85.13.in-addr.arpa
DNS Request
206.23.85.13.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
190.178.17.96.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
31.243.111.52.in-addr.arpa
DNS Request
31.243.111.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
186.178.17.96.in-addr.arpa