Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    28-01-2024 04:27

General

  • Target

    Lords Monitor.exe

  • Size

    417KB

  • MD5

    4a114995273b5a478cb5d1f4bfedb12d

  • SHA1

    d859974e863c6d8d325b24424790dd720051044f

  • SHA256

    80e57b1c5e90505dfab81291a9db92331649ecb8bb13dd026e70ac164711335e

  • SHA512

    5378f14e0132ba08857e29a1fb72d0007fd1e569e2157737f1ff42fe8e1ad6b8c752d40b9fbebd7adf4878acdf052931b4363b81d44882f401b5cc08967b6e69

  • SSDEEP

    3072:IVFe9Lh3pudG/GUnpaIvVm1fMF3pudG/GUnpaIvVm1fM+3pudG/GUnpKI9Vm1fMx:IMLh51ZQiF51ZQi+51LQiJT

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lords Monitor.exe
    "C:\Users\Admin\AppData\Local\Temp\Lords Monitor.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Users\Admin\AppData\Local\Temp\LordsMobileBot.exe
      "C:\Users\Admin\AppData\Local\Temp\LordsMobileBot.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Users\Admin\AppData\Local\Temp\Updater.exe
        "C:\Users\Admin\AppData\Local\Temp\Updater.exe" --no-diag
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3956
    • C:\Users\Admin\AppData\Local\Temp\LordsMobileBot.exe
      "C:\Users\Admin\AppData\Local\Temp\LordsMobileBot.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4688
      • C:\Users\Admin\AppData\Local\Temp\Updater.exe
        "C:\Users\Admin\AppData\Local\Temp\Updater.exe" --no-diag
        3⤵
          PID:232

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Updater.exe.log

      Filesize

      1KB

      MD5

      df27a876383bd81dfbcb457a9fa9f09d

      SHA1

      1bbc4ab95c89d02ec1d217f0255205787999164e

      SHA256

      8940500d6f057583903fde1af0287e27197410415639fc69beb39475fa5240dc

      SHA512

      fe68271375002cfcf8585c92b948ae47cd1632919c43db4bc738e2bc85ceea6dd30880dba27df9c3317531f1017624d4bd8979e6c5fad58112c7aa1189f0b844

    • C:\Users\Admin\AppData\Local\Temp\DN40B6560D6598ABA0\HVMRun64.dll

      Filesize

      4.3MB

      MD5

      21184c4444b13c67546c7acf7f6ad8e3

      SHA1

      806fb111900a0ec8bee1f658c6828b9e005f1111

      SHA256

      14f61c269509eb27083883d5e8edcf9ed14f3b62cfbfb69f4f7434d64a7fa924

      SHA512

      9c55f71051f7c83d8644c7eaf500a5ea887aa75886480fcb607e3540f482afde0cc11396e3c2be936bd6418ce76a752132391c97b2620927a9a694eee99380eb

    • C:\Users\Admin\AppData\Local\Temp\DN40B6560D6598ABA0\HVMRun64.dll

      Filesize

      617KB

      MD5

      dd69620ce2469f9d184a0963b49640f4

      SHA1

      c24901f99d69c95b8931bfee8c56950dc54eef5f

      SHA256

      074a4620b90ea5f91822b61d3f5fc4d446093f994e13e2b8d82f013db091b4e7

      SHA512

      13455cd1ee525fabe53d80243b2d65cdbc89fa5d8846c9317fc27b03dba2d09655c8c5fcba7a6ac5d789a6c214573c51f69b1c250adcc16d41a5ac040e40c6a5

    • C:\Users\Admin\AppData\Local\Temp\LordsMobileBot.dll.config

      Filesize

      1KB

      MD5

      a718311ed71ac3ff0a176092cadf1805

      SHA1

      46fb4f68bf06abcef5c765561297bd85e21f821e

      SHA256

      76b2d3852874363a03a9a06510581661bb8b45762ec81a6296643b91980f4acd

      SHA512

      2e3bda5fd7c83a41359ac20892981b8bf1db7565a4b215e533cb08e27e9a83a485b0f980ae357e356186d8ece33dd9e946d1ddf42d2f98f47c9c8d073d3d32b5

    • C:\Users\Admin\AppData\Local\Temp\appSettings.json

      Filesize

      2KB

      MD5

      77a059894f5b443e282cf65b0b881ead

      SHA1

      a31d9501ac2afb90fbb1fea2a469a5b75fcaba74

      SHA256

      31ba4b8f8dd7022d03fbd02fc17dd23294276302ca93dc7983f09ac0294fb97a

      SHA512

      e79b80722e15101d1b1372f296a27177ca9b1f86bded897fa395e99acfa13c72ad977c7b0be9cc0148f8a06e1859e40de2ea0b75b088f9bd8e57a25b02d4986a

    • C:\Users\Admin\AppData\Local\Temp\lm_settings.ini

      Filesize

      116B

      MD5

      84450fcda18ac067ccc498cd72da4a63

      SHA1

      aee3e00c313f39919090b1eaa182b9cb68d9a79a

      SHA256

      c3c6a0da9c71636db20136f70a5ce99df8ac78d57c68ad8ff8362204ddcd17df

      SHA512

      fb3c2ac20b28ad10c9e55271abc206d9997ca12cc46e71c4bfeacdf68d8a1d752efdc554ac91dd50c1e0a79dff78744cf2f1869b5108661b7b60c8f5bcd432da

    • memory/232-125-0x00000000744C0000-0x0000000074C70000-memory.dmp

      Filesize

      7.7MB

    • memory/232-126-0x0000000005980000-0x0000000005990000-memory.dmp

      Filesize

      64KB

    • memory/652-112-0x00007FF9982C0000-0x00007FF9987BE000-memory.dmp

      Filesize

      5.0MB

    • memory/652-49-0x00007FF9982C0000-0x00007FF9987BE000-memory.dmp

      Filesize

      5.0MB

    • memory/652-19-0x00007FF9982C0000-0x00007FF9987BE000-memory.dmp

      Filesize

      5.0MB

    • memory/652-24-0x00007FF997720000-0x00007FF997882000-memory.dmp

      Filesize

      1.4MB

    • memory/3956-31-0x00000000744C0000-0x0000000074C70000-memory.dmp

      Filesize

      7.7MB

    • memory/3956-30-0x0000000000A30000-0x0000000000A7A000-memory.dmp

      Filesize

      296KB

    • memory/3956-32-0x0000000005530000-0x0000000005540000-memory.dmp

      Filesize

      64KB

    • memory/3956-36-0x00000000744C0000-0x0000000074C70000-memory.dmp

      Filesize

      7.7MB

    • memory/4592-12-0x0000000008920000-0x0000000008A22000-memory.dmp

      Filesize

      1.0MB

    • memory/4592-44-0x0000000005310000-0x0000000005320000-memory.dmp

      Filesize

      64KB

    • memory/4592-43-0x00000000744C0000-0x0000000074C70000-memory.dmp

      Filesize

      7.7MB

    • memory/4592-1-0x00000000744C0000-0x0000000074C70000-memory.dmp

      Filesize

      7.7MB

    • memory/4592-113-0x0000000005310000-0x0000000005320000-memory.dmp

      Filesize

      64KB

    • memory/4592-8-0x0000000005310000-0x0000000005320000-memory.dmp

      Filesize

      64KB

    • memory/4592-5-0x00000000052B0000-0x00000000052BA000-memory.dmp

      Filesize

      40KB

    • memory/4592-4-0x0000000005310000-0x0000000005320000-memory.dmp

      Filesize

      64KB

    • memory/4592-3-0x0000000005120000-0x00000000051B2000-memory.dmp

      Filesize

      584KB

    • memory/4592-2-0x0000000005630000-0x0000000005BD4000-memory.dmp

      Filesize

      5.6MB

    • memory/4592-0-0x00000000006A0000-0x000000000070A000-memory.dmp

      Filesize

      424KB

    • memory/4688-114-0x00007FF999630000-0x00007FF999B2E000-memory.dmp

      Filesize

      5.0MB

    • memory/4688-117-0x00007FF9AAB40000-0x00007FF9AACA2000-memory.dmp

      Filesize

      1.4MB