Overview

overview

10

Static

static

5

d593053e56...7c.exe

windows7-x64

10

d593053e56...7c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/03/2024, 07:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    d593053e56b42f7d28eef97fcf70af7c.exe

  • Size

    512KB

  • MD5

    d593053e56b42f7d28eef97fcf70af7c

  • SHA1

    422bba8f394b61f76f23906c033c9de2f3058c57

  • SHA256

    989fcbe7be12611e5a1c4ce18654cfadecba92dff16ab60d9504ffd0d19d15c9

  • SHA512

    a877cc70ea8f1ba911de431f3719945d03be9e9d096d0bbf805717c88f861316235787dd7c89abdc4e6e9965c2b2ea778f8bbca0c3520c3842b5d295f6d511e5

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d593053e56b42f7d28eef97fcf70af7c.exe
    "C:\Users\Admin\AppData\Local\Temp\d593053e56b42f7d28eef97fcf70af7c.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\rkiggtrdyl.exe
      rkiggtrdyl.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Windows\SysWOW64\idpqvlpg.exe
        C:\Windows\system32\idpqvlpg.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2564
    • C:\Windows\SysWOW64\nuysfzdjocgvmgs.exe
      nuysfzdjocgvmgs.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2524
    • C:\Windows\SysWOW64\idpqvlpg.exe
      idpqvlpg.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2696
    • C:\Windows\SysWOW64\xjbjxiohocdlx.exe
      xjbjxiohocdlx.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2528
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2380

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
            Filesize

            512KB

            MD5

            e0b82e2d48a467b8923534c689ca14d9

            SHA1

            5d15b0cecb1981411e3745a7c726fe865d1a7175

            SHA256

            39381f50de8a766e217ce1da7f1a806b63e84ac1b61d3213fa69da55413bda57

            SHA512

            aeea5f7c78f63cec736791a926fc2401adf3cd433a115b737264ed25e93a4a5251f31af2146c5b777e3cd7edae3cecfbf6db7ee776ff215d617193a381726e17

            Download Submit

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            a762c9112429d5d971f164638e7b8ab7

            SHA1

            f041e49dc374ee1563625eb384e99cfceb4aeafb

            SHA256

            ef1d8172461ac68f91f8e971881879fd54484975b70124c94ec5cb6f7c57c4a3

            SHA512

            ad4966fe5b36b84ab743cd11f9559b3988e543ab2ea5dcd7c45a91a5ab235abf196c075a81079acaeeb9f431df5a91ba5c6f64a266cd596bdec6384c4f717485

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            5eaf8f2a756701bf644892c4500b7194

            SHA1

            172854a722d6f9b13eb0e3671bc1d2479b70afd4

            SHA256

            0a436d66fc68893e480faf121b19bbc922a6487a5c453bb2c8d77057ba0f8d5f

            SHA512

            3ae7bf95e8250b3876da72126b19910f170ac491d3f570f4eed51315d3ceddf0837ba63beb16295ccab12bf0a46ed8806061655b17e2e5a4c57f83506e664831

            Download Submit

          • C:\Windows\SysWOW64\nuysfzdjocgvmgs.exe
            Filesize

            512KB

            MD5

            f1354879576757459723c5d9a09d9886

            SHA1

            00d35ae1eaa5a1a1cfc3e4c2ea965b3e21bebb07

            SHA256

            d0e02142345aea2585dbe27d749ebb97edea58843eb23d701ad0255b09dd78b3

            SHA512

            5d7b0d858e9c7bfba8439bea7bf6cf6e8112bec91f391ca13c89a6fab6a5053ab267febfe65df343600c32131e5d8873a8a1d73be098d5d9306fa9ea0e3b6b22

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\idpqvlpg.exe
            Filesize

            512KB

            MD5

            80e30146b8ce6e5f3cbfda661ca74a78

            SHA1

            9d55d822197d21ba6a9f519ba2ed1d4a30e74e99

            SHA256

            4a490d96c2f71b14515b69d02bd669d81845e12876fbc522adbbf78cae47a873

            SHA512

            7c4dc3a808870c0de2f3e041006779ea6a908aefb9b6d82b44c8be57a330f7e0fd638e4767346f32096bd579ced2c46ae7a7913a9ee548d9bca1d4b7aa1732fa

            Download Submit

          • \Windows\SysWOW64\rkiggtrdyl.exe
            Filesize

            512KB

            MD5

            3c57d6f427b521dcf5bd626ff6e45b44

            SHA1

            51fad473a90b97dd40f33129e05b212b7e9a9b45

            SHA256

            e82686ddff60041971eb1b47f892792bd8d9f3f76f7334f7875f311e0ed6fc56

            SHA512

            f19e5c21f5f036e895d181494527ebda20d379d41ea67a2adb718b80d6a7bb7142dd76ec597de140ce92a46bd32df83839f9717e9637f287a8efbf3a6928ff97

            Download Submit

          • \Windows\SysWOW64\xjbjxiohocdlx.exe
            Filesize

            512KB

            MD5

            0f2d60d53a00f4cc6e97cfe6e4dec499

            SHA1

            95e8153a28255feeddf58912a2d82686fbaf208c

            SHA256

            c8a3bc49098bbfc283f334731378b0b7a99e01f4c101722d21d76ef592e7b6e7

            SHA512

            7428e89bf39de0eecd3d1e641cf393e36783593157282c1150fd7ef1069260884875c5906aa8ddc90476295aa71fcc22779636b8b9305ce06975dcfeb2789732

            Download Submit

          • memory/1908-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2408-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2408-47-0x000000007101D000-0x0000000071028000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2408-45-0x000000002F971000-0x000000002F972000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2408-79-0x000000007101D000-0x0000000071028000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2408-100-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download