23a91642bbbfc45279d3475e7391117905673b02fb166ba82dd875e6688c876d

General

Target
Office_2013-2024_C2R_Install/activate.exe
Size 332.5MB
Sample240407-ykmkcsdc38
SHA256 1257b591c67c8fc0d3c4490fd80c62ff98760f1a1a74b24920f38b24698e44be
MD5 858dd6a097f4745df576c37e01119ec2
SHA1 9c5c603f8eb74f6f3101611a94a597eb0d46765d
SHA512 d341e636146dd2e987cf3b5c6e128d0d32531f89719e088f6bec7912c54ee14b1abf2c60856bbe064b264252559351a9e6746a78134792cd7a08961070d860e5
SSDEEP 98304:zd2rIjP+6mg6sNHvmmzPwshcxfre/W6I/vuOFmCJl+6KZCOVgb:zd2rg+75sRmmLThcd6qmCyoOV0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	activate.exe

Executes dropped EXE 1 IoCs

pid	Process
1292	Davonevur.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1680	activate.exe
1680	activate.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	activate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	activate.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1680	activate.exe
1680	activate.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3696	1680	activate.exe	95
PID 1680 wrote to memory of 3696	1680	activate.exe	95
PID 1680 wrote to memory of 3696	1680	activate.exe	95
PID 3696 wrote to memory of 2488	3696	cmd.exe	97
PID 3696 wrote to memory of 2488	3696	cmd.exe	97
PID 3696 wrote to memory of 2488	3696	cmd.exe	97
PID 1680 wrote to memory of 4396	1680	activate.exe	98
PID 1680 wrote to memory of 4396	1680	activate.exe	98
PID 1680 wrote to memory of 4396	1680	activate.exe	98
PID 4396 wrote to memory of 1568	4396	cmd.exe	100
PID 4396 wrote to memory of 1568	4396	cmd.exe	100
PID 4396 wrote to memory of 1568	4396	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\activate.exe
"C:\Users\Admin\AppData\Local\Temp\Office_2013-2024_C2R_Install\activate.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand.exe "C:\Users\Admin\AppData\Roaming\ServiceData\c2Gt4H.tmp" -F:* "C:\Users\Admin\AppData\Roaming\ServiceData"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Roaming\ServiceData\c2Gt4H.tmp" -F:* "C:\Users\Admin\AppData\Roaming\ServiceData"
    3⤵
    - Drops file in Windows directory
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:1568

C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe
C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe "C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg"
1⤵
- Executes dropped EXE
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Davonevur.exe

Path C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.exe
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Davonevur.jpg

Path C:\Users\Admin\AppData\Roaming\ServiceData\Davonevur.jpg
Size 495KB
SHA256 a3b628be13ef3a1f09ab8e4af4f59203e7e721283bd9414f2a35c03abd0ecf46
MD5 b36280ab2514b1772d2058fe14633850
SHA1 57b4b40365eb4e26aa9f9125acc9965210776195
SHA512 7c13c658c2be4430aa7e6fa4a6b6116a91e5cf5c9ce425eb698236193b96d12656d264ce3f19940a17b8a59f7b7e5dfb1ea0c0c9dc381a788c3acf4f8fdfddfa
SSDEEP 3072:CF/o6tahdLBQ1WrwoLYs3CTWpAmrl+2JH3QLYWk0Mwoc8NJ3TEZB3sP86EPitDhB:o2l+2wYWNnopJ3k3sP86EPitDh4y
MD5 SHA1 SHA512 SSDEEP

Submit Download

c2gt4h.tmp

Path \??\c:\users\admin\appdata\roaming\servicedata\c2gt4h.tmp
Size 491KB
SHA256 6a30579a54855ff5899cd73278d61e6b3d69abadc7ffedc6c0e0c3aa03594131
MD5 9533ba8d9930f60f0b6257bdb79b2384
SHA1 b0b9dc920e83343784e818dcf4d9607de51118bb
SHA512 e86c782b98b28e8eefc03cb703eb2c640d6b748285b76c93f8a892e2427a20de00c7dd4c141e1c38e69b2f78b54f6705e2ae40071aaba0392193fc1a7071259d
SSDEEP 12288:LkigMKq/IfN5CRkKWNRqcROJIsEgQOFBx5y:LYMKq/IfvCkNg5JIssOFj5y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1680-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/1680-1-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/1680-2-0x0000000000710000-0x0000000001710000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads