Overview
overview
7Static
static
3e2117b441b...03.exe
windows7-x64
7e2117b441b...03.exe
windows10-2004-x64
7$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...ge.dll
windows7-x64
3$PLUGINSDI...ge.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...te.dll
windows7-x64
1$PLUGINSDI...te.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/nsisos.dll
windows7-x64
1$TEMP/nsisos.dll
windows10-2004-x64
1IDBoan.exe
windows7-x64
6IDBoan.exe
windows10-2004-x64
7IDBoanMon.exe
windows7-x64
3IDBoanMon.exe
windows10-2004-x64
3IDBoanUpdate.exe
windows7-x64
6IDBoanUpdate.exe
windows10-2004-x64
7Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 16:06
Static task
static1
Behavioral task
behavioral1
Sample
e2117b441bb00e4bd08f23ec09ecfe03.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
e2117b441bb00e4bd08f23ec09ecfe03.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DLLWebCount.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DLLWebCount.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ExLicenseIDBoanPage.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ExLicenseIDBoanPage.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$TEMP/nsisos.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral14
Sample
$TEMP/nsisos.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
IDBoan.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
IDBoan.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
IDBoanMon.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
IDBoanMon.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
IDBoanUpdate.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
IDBoanUpdate.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
IDBoanUpdate.exe
-
Size
1.8MB
-
MD5
5c26d3ae5bf2eafe78bb906d81047b48
-
SHA1
5badbfe50bca04ca88f4d1f336d1f925ef4da7f0
-
SHA256
7784f1f422aa413a4d556ad0b732b059564527c5d7ac2da5adbb2c9e89f39c5c
-
SHA512
ca7747cd4f4f125dff732bf36fcd2e89a02c01a500f117be650c46d3726cb6b032c5a4148f3618e4fc7b2746be3ee4e6d64b8bfc2edc280ebe4b918b10a6e25f
-
SSDEEP
49152:+t3dLZuK4AsiPdpnT2KkOd5GUEX4k0uBoxK+9:+t7z4As4t2KkOd5IX30yoo+9
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDBoan = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IDBoan.exe\" /run1" IDBoan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IDBoan.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0140A71-EC53-11EE-B559-5267BFD3BAD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2352 IDBoanUpdate.exe 2352 IDBoanUpdate.exe 2352 IDBoanUpdate.exe 2352 IDBoanUpdate.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe 2552 IDBoanMon.exe 2812 iexplore.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2352 IDBoanUpdate.exe 2352 IDBoanUpdate.exe 2352 IDBoanUpdate.exe 2352 IDBoanUpdate.exe 2252 IDBoan.exe 2252 IDBoan.exe 2252 IDBoan.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2352 IDBoanUpdate.exe 2352 IDBoanUpdate.exe 2252 IDBoan.exe 2252 IDBoan.exe 2552 IDBoanMon.exe 2552 IDBoanMon.exe 2252 IDBoan.exe 2812 iexplore.exe 2812 iexplore.exe 1172 IEXPLORE.EXE 1172 IEXPLORE.EXE 2252 IDBoan.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2252 2352 IDBoanUpdate.exe 28 PID 2352 wrote to memory of 2252 2352 IDBoanUpdate.exe 28 PID 2352 wrote to memory of 2252 2352 IDBoanUpdate.exe 28 PID 2352 wrote to memory of 2252 2352 IDBoanUpdate.exe 28 PID 2252 wrote to memory of 2552 2252 IDBoan.exe 29 PID 2252 wrote to memory of 2552 2252 IDBoan.exe 29 PID 2252 wrote to memory of 2552 2252 IDBoan.exe 29 PID 2252 wrote to memory of 2552 2252 IDBoan.exe 29 PID 2812 wrote to memory of 1172 2812 iexplore.exe 31 PID 2812 wrote to memory of 1172 2812 iexplore.exe 31 PID 2812 wrote to memory of 1172 2812 iexplore.exe 31 PID 2812 wrote to memory of 1172 2812 iexplore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDBoanUpdate.exe"C:\Users\Admin\AppData\Local\Temp\IDBoanUpdate.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\IDBoan.exe"C:\Users\Admin\AppData\Local\Temp\IDBoan.exe" /RUN02⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\IDBoanMon.exe"C:\Users\Admin\AppData\Local\Temp\IDBoanMon.exe"3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2552
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1172
-