Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
dba409d517d394e6fe810fe9b9b554f4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dba409d517d394e6fe810fe9b9b554f4.exe
Resource
win10v2004-20240226-en
General
-
Target
dba409d517d394e6fe810fe9b9b554f4.exe
-
Size
283KB
-
MD5
dba409d517d394e6fe810fe9b9b554f4
-
SHA1
167248b3d44f97f80324436b29c1ff286b9499ba
-
SHA256
db77815b4766ffa916220c582fce7bcaf383987efab92bf2c38cd6789c12e082
-
SHA512
41253995374c16372481559565cb4d6d79e17de47a3b86c3322e19bc79fd314f0bfc1b4dcd99dae951312cb7710ec9037fd7f829d305f197fe367fbc8b70a6aa
-
SSDEEP
6144:89GrX1EXSopNBF0BB2LceVV2LRENC/KkFCL4d6QuJVwGUFke:uSEXSopNBFow9mLRPKkALVduF
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
dba409d517d394e6fe810fe9b9b554f4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" dba409d517d394e6fe810fe9b9b554f4.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
A573.tmppid process 1196 A573.tmp -
Loads dropped DLL 2 IoCs
Processes:
dba409d517d394e6fe810fe9b9b554f4.exepid process 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2020-1-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2020-11-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1552-13-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2020-78-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2256-80-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2020-177-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2020-197-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2020-201-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2020-202-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
dba409d517d394e6fe810fe9b9b554f4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AC4.exe = "C:\\Program Files (x86)\\LP\\F2ED\\AC4.exe" dba409d517d394e6fe810fe9b9b554f4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
Processes:
dba409d517d394e6fe810fe9b9b554f4.exedescription ioc process File created C:\Program Files (x86)\LP\F2ED\AC4.exe dba409d517d394e6fe810fe9b9b554f4.exe File opened for modification C:\Program Files (x86)\LP\F2ED\AC4.exe dba409d517d394e6fe810fe9b9b554f4.exe File opened for modification C:\Program Files (x86)\LP\F2ED\A573.tmp dba409d517d394e6fe810fe9b9b554f4.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
dba409d517d394e6fe810fe9b9b554f4.exepid process 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe 2020 dba409d517d394e6fe810fe9b9b554f4.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 948 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
msiexec.exeexplorer.exedescription pid process Token: SeRestorePrivilege 2668 msiexec.exe Token: SeTakeOwnershipPrivilege 2668 msiexec.exe Token: SeSecurityPrivilege 2668 msiexec.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe Token: SeShutdownPrivilege 948 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
explorer.exepid process 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe 948 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
dba409d517d394e6fe810fe9b9b554f4.exedescription pid process target process PID 2020 wrote to memory of 1552 2020 dba409d517d394e6fe810fe9b9b554f4.exe dba409d517d394e6fe810fe9b9b554f4.exe PID 2020 wrote to memory of 1552 2020 dba409d517d394e6fe810fe9b9b554f4.exe dba409d517d394e6fe810fe9b9b554f4.exe PID 2020 wrote to memory of 1552 2020 dba409d517d394e6fe810fe9b9b554f4.exe dba409d517d394e6fe810fe9b9b554f4.exe PID 2020 wrote to memory of 1552 2020 dba409d517d394e6fe810fe9b9b554f4.exe dba409d517d394e6fe810fe9b9b554f4.exe PID 2020 wrote to memory of 2256 2020 dba409d517d394e6fe810fe9b9b554f4.exe dba409d517d394e6fe810fe9b9b554f4.exe PID 2020 wrote to memory of 2256 2020 dba409d517d394e6fe810fe9b9b554f4.exe dba409d517d394e6fe810fe9b9b554f4.exe PID 2020 wrote to memory of 2256 2020 dba409d517d394e6fe810fe9b9b554f4.exe dba409d517d394e6fe810fe9b9b554f4.exe PID 2020 wrote to memory of 2256 2020 dba409d517d394e6fe810fe9b9b554f4.exe dba409d517d394e6fe810fe9b9b554f4.exe PID 2020 wrote to memory of 1196 2020 dba409d517d394e6fe810fe9b9b554f4.exe A573.tmp PID 2020 wrote to memory of 1196 2020 dba409d517d394e6fe810fe9b9b554f4.exe A573.tmp PID 2020 wrote to memory of 1196 2020 dba409d517d394e6fe810fe9b9b554f4.exe A573.tmp PID 2020 wrote to memory of 1196 2020 dba409d517d394e6fe810fe9b9b554f4.exe A573.tmp -
System policy modification 1 TTPs 2 IoCs
Processes:
dba409d517d394e6fe810fe9b9b554f4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer dba409d517d394e6fe810fe9b9b554f4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" dba409d517d394e6fe810fe9b9b554f4.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dba409d517d394e6fe810fe9b9b554f4.exe"C:\Users\Admin\AppData\Local\Temp\dba409d517d394e6fe810fe9b9b554f4.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\dba409d517d394e6fe810fe9b9b554f4.exeC:\Users\Admin\AppData\Local\Temp\dba409d517d394e6fe810fe9b9b554f4.exe startC:\Users\Admin\AppData\Roaming\D4788\CFEF2.exe%C:\Users\Admin\AppData\Roaming\D47882⤵
-
C:\Users\Admin\AppData\Local\Temp\dba409d517d394e6fe810fe9b9b554f4.exeC:\Users\Admin\AppData\Local\Temp\dba409d517d394e6fe810fe9b9b554f4.exe startC:\Program Files (x86)\88658\lvvm.exe%C:\Program Files (x86)\886582⤵
-
C:\Program Files (x86)\LP\F2ED\A573.tmp"C:\Program Files (x86)\LP\F2ED\A573.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\D4788\8658.478Filesize
600B
MD50540df447571bba88b94c55b4400b52b
SHA1a3450b4009ddd1d21ef64b22a5e6084431a12110
SHA256896da0c994965b2af2ee544cd6b01e40c967547883ddeee6109a73beffaf0037
SHA512a88519c2f98be258f3a90859ddd8492594fd24115d70d4034c499d4bb1e3422a701c1c9a8c2d796dbd1a3750617c0938174984544c1e540738f145ac3efb31f7
-
C:\Users\Admin\AppData\Roaming\D4788\8658.478Filesize
1KB
MD510afd24fd94fe9a4ef0b2412fdee75a3
SHA1934cbb60267f59924d06f2c05f29f4d70fdecc4c
SHA256521ca2c130e75721ba278750d6df51584714fbe358c68c98cfee82d0f531996e
SHA51260328968809cc51fa8747344d536bff552ccbab9dbe3d2ba7c47fc7fed8a367c6d361326eb172535ef567f1703af55a2774ce90992a2944a7b55cdb042bbc5a3
-
C:\Users\Admin\AppData\Roaming\D4788\8658.478Filesize
996B
MD5953e4fafea5c6cde0c93e01f9b7ba8ea
SHA17db03f091d835ff2facdad7d6ea135a7bfcdf0b0
SHA256edb3f06679e75815c7bb2e6e62544d0ec36c1db59cc3eda9ed9f031543d7b311
SHA5126a075938e888b092f8050b0de3b80cbe3be065ba350888049264637d7547e25195453caea29691a4f18ba14d7261326aea81cef1518d73a42e6b924a0120be35
-
\Program Files (x86)\LP\F2ED\A573.tmpFilesize
100KB
MD57d9a7a08eaeb2f656e3f68ebf0154658
SHA1df305c4d5417ffbcfadf3a8345df3c8ebdcd2a21
SHA256ff8251a72bfe8c2cedb6385486e48a350ff03a8dc3bafec1296140c5e2f6e9aa
SHA512c22378d51662a1190766e696132465317c558264741d2aed44985774760b7bc793749ef7db4ffb3282488e2bc59263bf784035ec74a8077a7ae6f69fc62dfd93
-
memory/948-199-0x0000000004320000-0x0000000004321000-memory.dmpFilesize
4KB
-
memory/948-111-0x0000000004320000-0x0000000004321000-memory.dmpFilesize
4KB
-
memory/1196-194-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1196-196-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1196-195-0x00000000005C0000-0x00000000006C0000-memory.dmpFilesize
1024KB
-
memory/1552-13-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1552-14-0x0000000000689000-0x00000000006CF000-memory.dmpFilesize
280KB
-
memory/2020-110-0x00000000005D0000-0x00000000006D0000-memory.dmpFilesize
1024KB
-
memory/2020-177-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2020-11-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2020-2-0x00000000005D0000-0x00000000006D0000-memory.dmpFilesize
1024KB
-
memory/2020-78-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2020-197-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2020-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2020-201-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2020-202-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2256-80-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2256-81-0x0000000000529000-0x000000000056F000-memory.dmpFilesize
280KB