Overview
overview
7Static
static
7e1593dd6e5...82.exe
windows7-x64
7e1593dd6e5...82.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3DomaIQ.exe
windows7-x64
1DomaIQ.exe
windows10-2004-x64
1DomaIQ10.exe
windows7-x64
1DomaIQ10.exe
windows10-2004-x64
1OfferBroke...03.exe
windows7-x64
6OfferBroke...03.exe
windows10-2004-x64
6config.dll
windows7-x64
1config.dll
windows10-2004-x64
1routes.dll
windows7-x64
1routes.dll
windows10-2004-x64
1setup__120.exe
windows7-x64
7setup__120.exe
windows10-2004-x64
7Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 09:34
Behavioral task
behavioral1
Sample
e1593dd6e5ab80b64e55c4e2a2c11882.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1593dd6e5ab80b64e55c4e2a2c11882.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
DomaIQ.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
DomaIQ.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
DomaIQ10.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
DomaIQ10.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
OfferBrokerage_14003.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
OfferBrokerage_14003.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
config.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
config.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
routes.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
routes.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
setup__120.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
setup__120.exe
Resource
win10v2004-20240226-en
General
-
Target
DomaIQ.exe
-
Size
342KB
-
MD5
5e738ce64ecf55da1cd48802a7c71728
-
SHA1
8059044cb6db8138d4ce859d547f3edf44a5ae8a
-
SHA256
9cfcc4e9519052814724aef4a32d591690ebaa271a14b2d8e45d2857f035bec9
-
SHA512
89ec8a90f2f61de55ae88fdc79ab32e8a74fcfa0ac9f5757de0fcb4e5629ac5c43707304ce09ba41f4547b9882d505725a4f357c0a9b916421de6d300c2c30f9
-
SSDEEP
6144:bMxDCNU8UqzcgEoysbFKAw4OgmQi6Wudtw/AJu0LSpm:lW8UEcfFGhsQ7O/AJuJm
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1168 DomaIQ.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1168 DomaIQ.exe 1168 DomaIQ.exe