46604cb79716d7402b03cf68c6aa353d1c560d750bc82a1b4d549309a4d58ff4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Email-Worm/Lentin/Lentin.c.exe
Size

1.2MB
MD5

04ee0eff07a7e545f7052031ca0d8133
SHA1

56676f042cca5170a82f1fdc38648923297e8147
SHA256

50d60cd841a18b05e00ab4691fc1e30f6a099a65a58ba51080304205fbb0d666
SHA512

f4edcf31e36c94c1c568ec066edb961e7be6bdd25121cc118d5f19379cc57ab1db16ed14487c56d3838543b7668ce2b79f8ff510a646ae1216de811a23330551
SSDEEP

24576:yNybvnjuTqLU1P5sRs+89LvlFoizMADpTh+Dj0ZRze:tnqTD1BICiizMIpA3g6

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

Lentin.c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Lentin.c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"c:\\recycled\\qurru\" %1 %*"	Lentin.c.exe

Drops file in Windows directory 3 IoCs

Processes:

Lentin.c.exe

description	ioc	process
File created	C:\Windows\.txt	Lentin.c.exe
File opened for modification	C:\Windows\qurruqurru.dll	Lentin.c.exe
File created	C:\Windows\qurru.txt	Lentin.c.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

Lentin.c.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Software\Microsoft\Internet Explorer\Main Lentin.c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Software\Microsoft\Internet Explorer\Main	Lentin.c.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

Lentin.c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.kerala.com"	Lentin.c.exe

Modifies registry class 2 IoCs

Processes:

Lentin.c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Lentin.c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"c:\\recycled\\qurru\" %1 %*"	Lentin.c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Lentin.c.exe

description pid process

Token: SeSystemtimePrivilege 3192 Lentin.c.exe

description	pid	process
Token: SeSystemtimePrivilege	3192	Lentin.c.exe

C:\Users\Admin\AppData\Local\Temp\Email-Worm\Lentin\Lentin.c.exe
"C:\Users\Admin\AppData\Local\Temp\Email-Worm\Lentin\Lentin.c.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3192

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3192-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3192-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3192-4-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download