Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
14/02/2024, 12:25
General
- Target 9baaa00dc7499eb86af805c5dfb9a2e8.exe
- Size 19KB
- Sample240214-plndlsac5x
- SHA256 8225d7361e3aa89ed047a89083444046fb5ba4e42372d04b69a8b61a21f7dd60
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- UPX packed file 36 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Modifies Internet Explorer settings 1 TTPs 11 IoCs
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9baaa00dc7499eb86af805c5dfb9a2e8.exe"C:\Users\Admin\AppData\Local\Temp\9baaa00dc7499eb86af805c5dfb9a2e8.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmon.exectfmon.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iebtmm.exeC:\Users\Admin\AppData\Local\Temp\iebtmm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iebt.dll
iebtmm.exe
memory/1352-17-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-39-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-45-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-43-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-15-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-41-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-27-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-47-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-37-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-20-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-35-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-33-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-31-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-29-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1352-25-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2428-18-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-19-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-28-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-24-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-30-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-22-0x0000000000220000-0x000000000022A000-memory.dmp
memory/2428-32-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-23-0x0000000000220000-0x000000000022A000-memory.dmp
memory/2428-34-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-21-0x0000000010000000-0x000000001000D000-memory.dmp
memory/2428-36-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-26-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-38-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-0-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-16-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-40-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-42-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-13-0x0000000000220000-0x000000000022A000-memory.dmp
memory/2428-44-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-14-0x0000000000220000-0x000000000022A000-memory.dmp
memory/2428-46-0x0000000000400000-0x000000000040F000-memory.dmp
memory/2428-4-0x0000000010000000-0x000000001000D000-memory.dmp