Overview
overview
7Static
static
7e1593dd6e5...82.exe
windows7-x64
7e1593dd6e5...82.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3DomaIQ.exe
windows7-x64
1DomaIQ.exe
windows10-2004-x64
1DomaIQ10.exe
windows7-x64
1DomaIQ10.exe
windows10-2004-x64
1OfferBroke...03.exe
windows7-x64
6OfferBroke...03.exe
windows10-2004-x64
6config.dll
windows7-x64
1config.dll
windows10-2004-x64
1routes.dll
windows7-x64
1routes.dll
windows10-2004-x64
1setup__120.exe
windows7-x64
7setup__120.exe
windows10-2004-x64
7Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 09:34
Behavioral task
behavioral1
Sample
e1593dd6e5ab80b64e55c4e2a2c11882.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
e1593dd6e5ab80b64e55c4e2a2c11882.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
DomaIQ.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral10
Sample
DomaIQ.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
DomaIQ10.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
DomaIQ10.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
OfferBrokerage_14003.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral14
Sample
OfferBrokerage_14003.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
config.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
config.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
routes.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
routes.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
setup__120.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral20
Sample
setup__120.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
setup__120.exe
-
Size
145KB
-
MD5
a90dc54ac25bd460ae68b3b718ce8fce
-
SHA1
b2738e14fd684925e46b726f099955a81de328b9
-
SHA256
4900ca5c8763e510ab897d37df1d6621c7585a87720f8aa47c05c5b505a6759e
-
SHA512
c289c94c2d4bca10e24e2d1225862209affb7e35fb2e24e4d3d173e43c966bbf696ae8b9db896ecca5178616cb7bd2de44bb1211e00003a049355fea09f119f5
-
SSDEEP
3072:samWXrLYuX6Dg61CZTakdl+hVL2j0/VdRr4bdUPQHpWoIgGLXYsHMS9hq:saL7sd9vYl+byjcRr4A4pWor0XYtSG
Malware Config
Signatures
-
resource yara_rule behavioral19/memory/1712-0-0x00000000000B0000-0x0000000000110000-memory.dmp upx behavioral19/memory/1712-2-0x00000000000B0000-0x0000000000110000-memory.dmp upx -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35} setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\VersionIndependentProgID setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot.1\CLSID setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\VersionIndependentProgID setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\TypeLib setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\FLAGS setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib\Version = "1.0" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\ProgID setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\ = "BootStrapperLib" setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ = "IBoot" setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot.1 setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35} setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\HELPDIR setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ = "IBoot" setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0 setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\Programmable setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot\ = "Boot Class" setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\setup__120.exe" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220} setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot\CurVer setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93} setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\FLAGS setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot.1\CLSID setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot\CurVer\ = "AmiBs.Boot.1" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93} setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\Version setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\setup__120.exe\"" setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib\Version = "1.0" setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\0\win32 setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0 setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot.1\CLSID\ = "{F04A2CA1-9140-4553-B6C4-03E4139ECA93}" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\Version\ = "1.0" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35} setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32 setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\LocalServer32 setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot.1 setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AmiBs.Boot.1\ = "Boot Class" setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\VersionIndependentProgID\ = "AmiBs.Boot" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\ = "Boot Class" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\Programmable setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\0\win32 setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\ProgID\ = "AmiBs.Boot.1" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\0 setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220} setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\LocalServer32 setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\ProgID setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\TypeLib setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32 setup__120.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32 setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F04A2CA1-9140-4553-B6C4-03E4139ECA93}\Version setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35} setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib\ = "{4ECB13A5-757F-472B-8E54-EE529A450220}" setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4ECB13A5-757F-472B-8E54-EE529A450220}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\setup__120.exe" setup__120.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32 setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup__120.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CD3C5A4-7E59-4B22-9DAF-62FF27C45E35}\TypeLib\ = "{4ECB13A5-757F-472B-8E54-EE529A450220}" setup__120.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1712 setup__120.exe 1712 setup__120.exe