Overview

overview

10

Static

static

5

beb0ce0ae4...6b.exe

windows7-x64

10

beb0ce0ae4...6b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    10-03-2024 13:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    beb0ce0ae439be0520015a4d5360f26b.exe

  • Size

    512KB

  • MD5

    beb0ce0ae439be0520015a4d5360f26b

  • SHA1

    22c23fac685196f5ce36f742542729eebd309445

  • SHA256

    b0da068cbcccf587b4f6f6f7fa90e23ef7a7c559b17ca0368463fec8244ef4fe

  • SHA512

    16487cca3afe3f5773c76d5c6a81f01d96c32b6fa8522644a928a0b8c5126ab9440594e37dfa723e56bade83b753eb6e9e87e16086e87d65a5df3d0f790b5ef7

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\beb0ce0ae439be0520015a4d5360f26b.exe
    "C:\Users\Admin\AppData\Local\Temp\beb0ce0ae439be0520015a4d5360f26b.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:824
    • C:\Windows\SysWOW64\cqybplfxkm.exe
      cqybplfxkm.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\kutuakon.exe
        C:\Windows\system32\kutuakon.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2724
    • C:\Windows\SysWOW64\jfdlvdsmixbpymo.exe
      jfdlvdsmixbpymo.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3040
    • C:\Windows\SysWOW64\kutuakon.exe
      kutuakon.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2784
    • C:\Windows\SysWOW64\cztlavfvwhmkc.exe
      cztlavfvwhmkc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2652
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2628

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      bebb54ea6f7924651fbd924e341b408b

      SHA1

      8273a8ba85d923f818448f5df624edb07d0664e8

      SHA256

      2ab459cdac0f81d36ea42bac408b7d2b742d0c9db7b20d36b899e988e7a7c923

      SHA512

      569912e254f71c31ffc7eb6b7110bd86ddc69e0f0b11c8aa3d6c24344b3d83cb62cf359c5d4b5fef7bf31ce033fc2f0a07b76dd8183c87ee9a71372f31135d41

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      689639688558e7d3ce879a760797756b

      SHA1

      c44f259e61a73709aff91504475a34add3760619

      SHA256

      674570ac6cf58569a879572b569943910cd193470ef69f9a415cc2ccf52d85c0

      SHA512

      8f7c41dc7b4a76b61fc98ede1a1de2f67845dcfd1c1c3946a4fcc0877684a7c5be93c12dfc9500e13664cbe770976a5c7fe504adb2df19907bb161d409e94c2b

      Download Submit

    • C:\Windows\SysWOW64\jfdlvdsmixbpymo.exe
      Filesize

      512KB

      MD5

      8f8d6eaf706779bdbac628ca4e81b66c

      SHA1

      0e8bbf6c4a4b596141d0add0f45c3e48912a2a8c

      SHA256

      01a707160c2f6866367bfe87b791ca05fb9f80b59fcabbcb67d113b275507c6f

      SHA512

      28970862483b933cab38ac714ed89140f51d84ddb99addbb5eb55415f85e346ec0f8db0b8c86088541741c75249749c4e55d6805fa4ffeb84757b441c9ae4483

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\cqybplfxkm.exe
      Filesize

      512KB

      MD5

      d4124f0efd404c047ae86da3a87cf246

      SHA1

      5c7664391c257e3fe0b847066a24f841c067a2c5

      SHA256

      88ffc4ec5ac8f9d6a2e89caecb97bee3ba9d89e358787494e9cf60991507c4e5

      SHA512

      d5ae30273e3997a9ce692095cb5c7cc5fbaaf6a54d42759ada1c4a8dfa3d6414e14d522deeec153f577adb95cc66a74088506df7dc8757c985610f595ee704b2

      Download Submit

    • \Windows\SysWOW64\cztlavfvwhmkc.exe
      Filesize

      512KB

      MD5

      7edc81b0b8b4f8ab57f41f01f7b17b61

      SHA1

      74511c5992933a337eab4f685240403db8cc194e

      SHA256

      c7f6fd250c8ef86b8e56880dafb9f99fac59a0ff5b6abc1b436ec6c13ba89301

      SHA512

      3967d65957304f8e454e8164e1a771baedda73c72aea8674637d5ffab451c86784d956e8636cf26dc20f2ed9ca524de722a023932f8ba52af988a25a526a7567

      Download Submit

    • \Windows\SysWOW64\kutuakon.exe
      Filesize

      512KB

      MD5

      93d8cc916619c67e88074f5dc7ab6e39

      SHA1

      bee45111e3fb10a07cb0817bcb7256aeeae3e984

      SHA256

      a29104f0d6e51739a8f36e8a4e720d3383654df06e9118530b6dd0fcb47d9dc8

      SHA512

      ba3308fe05a05de8c1dd89bf6b609471539e16854bc12539592e22e7e0016146f6f5f492f3e438349970a8a9e4492dab8df1760770ea6e846cbf713a723e2162

      Download Submit

    • memory/824-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2480-47-0x0000000071A4D000-0x0000000071A58000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2480-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2480-45-0x000000002F741000-0x000000002F742000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2480-77-0x0000000071A4D000-0x0000000071A58000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2480-98-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download