Overview

overview

10

Static

static

5

c2626a16c0...54.exe

windows7-x64

10

c2626a16c0...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-03-2024 03:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c2626a16c0d85ff79548c279a32e1854.exe

  • Size

    512KB

  • MD5

    c2626a16c0d85ff79548c279a32e1854

  • SHA1

    66e60b5853161e486515edcb1d5dea204161743d

  • SHA256

    38c6295c3948c56544cdd57f10955d26b04bc6c78e77a19ec9c72a826fcc905c

  • SHA512

    4dd8a6ea8d2759e3dae39829729880b7f54ac62339dc79980c57f7d427b9f24e52873af6177cbe425ca838b7de231831fd3d7a2265a979e181a2cbaa1c4398f8

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5g

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2626a16c0d85ff79548c279a32e1854.exe
    "C:\Users\Admin\AppData\Local\Temp\c2626a16c0d85ff79548c279a32e1854.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Windows\SysWOW64\itijxttaas.exe
      itijxttaas.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\Windows\SysWOW64\ettrilkk.exe
        C:\Windows\system32\ettrilkk.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2884
    • C:\Windows\SysWOW64\nakxtjvlllonhsp.exe
      nakxtjvlllonhsp.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2928
    • C:\Windows\SysWOW64\ettrilkk.exe
      ettrilkk.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2672
    • C:\Windows\SysWOW64\olkvocfelzdpc.exe
      olkvocfelzdpc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2568
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1244

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      d39c4132e565d5a98ca9f47fdf36dd26

      SHA1

      577c0aca39b92fdee80e9c6157d5aa164092c033

      SHA256

      426d50d45a9844e0e84701666b78df6ea4d90a5c2ebe331d4f0a98c21099af8c

      SHA512

      6225667099cd974224f47a72f31be9ebba05a684447b89dc8a3b6ef904b4fd5dff8f2a2457fb08a5b9a53de551d15d15ce757484f84825e71d685b79503e2fb9

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      cc5c1856d002c2c282b299f208bb4091

      SHA1

      3e2e76c421f498bfd4a308b7a109268128059c91

      SHA256

      4c77d9078846819d2b3d616676c076c0959021e70b1a3c0303497f82cb12a48b

      SHA512

      b34605a522c176701a94dee1d84036129576138f7fc70206fe628d24bbb932e791281e30fac57439f6542bd29fe1eb4c325baee0cf317e0cdf2b0602c789db7b

      Download Submit

    • C:\Windows\SysWOW64\ettrilkk.exe
      Filesize

      512KB

      MD5

      5421cb1cbba708b4ea0c07a64e19ffed

      SHA1

      9667419b526c83905b2456a5cc3b17cb320ba48c

      SHA256

      d3ff18b4c4808393aaed293e30733cb03eab694e34439d82e77b5cc9e9c16cad

      SHA512

      f89a18405de14bb7d0da267798935e952f29d6161e007c7f298976e9099ab72217eeca283032818d8cf764efe4bc1c9e86c722b1c192e5050fff5e1f8e1d075d

      Download Submit

    • C:\Windows\SysWOW64\ettrilkk.exe
      Filesize

      167KB

      MD5

      8e5fdb8a68dbb45e3861567b16c8a0dd

      SHA1

      ae10fd94c7742f090c7192e44e8585923bb0fc4d

      SHA256

      ea249a229cc0f4115f74fb27142d580a0c71b80757bd96aac129de591d460073

      SHA512

      00c500beca7dbb4f85dbe0f6b56507020f01087d87c04887b5c3cd771714b8334f543bbdcc3b650197fcfb9157bf65d351e7cd3cf07e7bcdcd73c770e6f4765a

      Download Submit

    • C:\Windows\SysWOW64\ettrilkk.exe
      Filesize

      512KB

      MD5

      c941a2deb75653aefc464707f779abd5

      SHA1

      54e71ad6ba0e1b36b8152ae46bfaac24aab986b3

      SHA256

      7890196ce7c9a1b1b469b78b6c39118e33e3c2867870568d53b5f096d700c254

      SHA512

      932f0f0bcd89cf17090d401a674057e547c443525f695c3c14897a6109996127e2dcfb7f8ec181fbc1f922519adbabd61049405722694f6e5ebc235fe3cf4251

      Download Submit

    • C:\Windows\SysWOW64\nakxtjvlllonhsp.exe
      Filesize

      256KB

      MD5

      a6912481eb039ab8ce8e65eefa5ac57b

      SHA1

      5859f27fff5ebd524ebd24615ab41f86fba46f02

      SHA256

      660f3560eeba127d97ee2570ed1c2dacd357f42f6136589ecedd2aa3004dccb4

      SHA512

      8f3bd0fa20db122cacaaeb9cba2d755db7a1d51371da190ea9337429d514ebde3336cd55f2db82358e06fe8f7906f50cb1799cb494875e3e38f478640697db40

      Download Submit

    • C:\Windows\SysWOW64\nakxtjvlllonhsp.exe
      Filesize

      512KB

      MD5

      fa4d3e6b76656cfa71f1c39af1c20139

      SHA1

      31a9beadcc8f4123f4f01849d9c54750f789e7c9

      SHA256

      5b21c262a92ec2faf1429f9609a7b38ef4520facdad9ca5fb5e30ab6cc377528

      SHA512

      b24c7b325826e612178edae88040ddaf14b88099ecc0303a98157c914008f655b97b8f19063f687e32a0d36b09d4c91047298a5773476d459133162deb1efc07

      Download Submit

    • C:\Windows\SysWOW64\olkvocfelzdpc.exe
      Filesize

      512KB

      MD5

      a7c33087ef24883d23f6c5173a57dc8a

      SHA1

      b03b9ff5f1f678cc2d03fd616c06b20eeba07172

      SHA256

      6030db73b71b79c19d149e2dda565c10472b6ba8a0f8ac9ece0335855171fb10

      SHA512

      bfb8dfe4fdb9977811c51e95ee90f57d4f70e58aaefb66964808fc4d8282cca49c31d01cd372c78e719fe3904339b1265b8f903db822d9b65d32f615a3d0cd1c

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\ettrilkk.exe
      Filesize

      384KB

      MD5

      0e151ec3919b72f9a6c7fe60d10f4ea0

      SHA1

      91fb01badc6db9808233ff95abf39c37982a8c85

      SHA256

      f644299fe8f10c5f3e24c1943fc808270b5d4f853e2316abf091c8d18344193c

      SHA512

      41d25f82ce04a14c21d19a9ad2d12663714221b6ecb1c3ee579a4a134949de0bfb3e6212e9acf97d0659d50e7a034dcdc103ecbedd8a71fbfefdc30f5728c12b

      Download Submit

    • \Windows\SysWOW64\itijxttaas.exe
      Filesize

      512KB

      MD5

      5fa85331e92259ad35c58bbbd16f8461

      SHA1

      53d3cd39a110d54b8ddb94090e22a9dc86ade332

      SHA256

      c6dab54e4feeedf21fb43f32cea14ccb970c8a8319fbb104bc6a3ec0d7c3d852

      SHA512

      ee7959f0d83014f9a0b655d4022ab99924dabc67bb0c0a7ec46a0230c3e22943e4498d9e5774f985bafb4d2f7951bb181e9431b82567264dc5aa9b289e3ec9f2

      Download Submit

    • memory/1308-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2608-45-0x000000002F9B1000-0x000000002F9B2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2608-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2608-47-0x0000000070C0D000-0x0000000070C18000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2608-77-0x0000000070C0D000-0x0000000070C18000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2608-98-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download