Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-02-2024 17:07
Behavioral task
behavioral1
Sample
HMZLEP.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
HMZLEP.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
HMZLEP.exe
-
Size
1.3MB
-
MD5
90bd60018898cfa0996e4ab4d53e3443
-
SHA1
5e2389308534903b7a399765268ee75fa1ee258e
-
SHA256
8c3e623134705c79cd342a51b89016f96cea3e2d9f2c36dfe38351d123a42e7b
-
SHA512
c76c7d7a5738d3d2fede883e2a67643c007f6dbaf4ada7a27748d46ebf19a5468661d7df447349f4790e719dfd92ad4a1e21341ff693f8164411618f81f60561
-
SSDEEP
24576:ethEVaPqLqjuTGczYcXga6C7WrmjSD2IrKFhoV7N:mEVUcqjuTGczjSA2DVrKURN
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 15 IoCs
resource yara_rule behavioral1/memory/840-0-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-209-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-217-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-226-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-234-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-244-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-253-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-261-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-269-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-279-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-287-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-296-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-304-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-314-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/840-322-0x0000000000400000-0x00000000004CA000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/840-0-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-209-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-217-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-226-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-234-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-244-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-253-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-261-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-269-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-279-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-287-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-296-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-304-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-314-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/840-322-0x0000000000400000-0x00000000004CA000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: HMZLEP.exe File opened (read-only) \??\j: HMZLEP.exe File opened (read-only) \??\k: HMZLEP.exe File opened (read-only) \??\r: HMZLEP.exe File opened (read-only) \??\x: HMZLEP.exe File opened (read-only) \??\u: HMZLEP.exe File opened (read-only) \??\a: HMZLEP.exe File opened (read-only) \??\h: HMZLEP.exe File opened (read-only) \??\l: HMZLEP.exe File opened (read-only) \??\m: HMZLEP.exe File opened (read-only) \??\q: HMZLEP.exe File opened (read-only) \??\s: HMZLEP.exe File opened (read-only) \??\t: HMZLEP.exe File opened (read-only) \??\y: HMZLEP.exe File opened (read-only) \??\z: HMZLEP.exe File opened (read-only) \??\i: HMZLEP.exe File opened (read-only) \??\o: HMZLEP.exe File opened (read-only) \??\w: HMZLEP.exe File opened (read-only) \??\e: HMZLEP.exe File opened (read-only) \??\g: HMZLEP.exe File opened (read-only) \??\n: HMZLEP.exe File opened (read-only) \??\p: HMZLEP.exe File opened (read-only) \??\v: HMZLEP.exe -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/840-209-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-217-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-226-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-234-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-244-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-253-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-261-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-269-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-279-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-287-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-296-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-304-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-314-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/840-322-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wl.jpg" HMZLEP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop HMZLEP.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe 840 HMZLEP.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD55aa90a0f7830666ef1360b39cbb406db
SHA1f189fbf1ae1a75bab23e5aa0d950db1eb4b72fee
SHA256ddafb9b732aced96a8b9c3d6fbaa9d69b2c116b7e486270ea42df1b6bb6099fa
SHA5120ffd27800fe704c39f8444bb006a6b4e34d5e6443f89aaaf8a21b2f5ea2cf55ad768ed5e57d117f5950ce225ac7ba184a98a895eef7826687d8b09e2ec997a91
-
Filesize
8B
MD5de6fdff1993c731e52e49d52a6e684d9
SHA1120d1ff8a24109eed24ac1a5697383d50bcc0f47
SHA256645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42
SHA51299d05bf76a3a7466ccf27ac304ba35639716089d8dae388aaa707bfb6feb3f362251a65951663dd86abcac5a5e7358a5f29faedfe4c0b55ae136ba9d8f1209c1
