Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
14/02/2024, 12:25
General
- Target 9baaa00dc7499eb86af805c5dfb9a2e8.exe
- Size 19KB
- Sample240214-plndlsac5x
- SHA256 8225d7361e3aa89ed047a89083444046fb5ba4e42372d04b69a8b61a21f7dd60
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Modifies Internet Explorer settings 1 TTPs 11 IoCs
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9baaa00dc7499eb86af805c5dfb9a2e8.exe"C:\Users\Admin\AppData\Local\Temp\9baaa00dc7499eb86af805c5dfb9a2e8.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iebtmm.exeC:\Users\Admin\AppData\Local\Temp\iebtmm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iebt.dll
iebtmm.exe
memory/1272-16-0x0000000010000000-0x000000001000D000-memory.dmp
memory/1272-17-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-39-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-11-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-37-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-13-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-14-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-35-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-27-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-5-0x0000000010000000-0x000000001000D000-memory.dmp
memory/1272-33-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-19-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-31-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-21-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-0-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-23-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-29-0x0000000000400000-0x000000000040F000-memory.dmp
memory/1272-25-0x0000000000400000-0x000000000040F000-memory.dmp
memory/3956-22-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-26-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-28-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-24-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-30-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-20-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-32-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-18-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-34-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-15-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-36-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-12-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-38-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-10-0x0000000000400000-0x000000000040A000-memory.dmp
memory/3956-40-0x0000000000400000-0x000000000040A000-memory.dmp