Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 03:21
Static task
static1
Behavioral task
behavioral1
Sample
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe
Resource
win10v2004-20240508-en
General
-
Target
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe
-
Size
70KB
-
MD5
68c8d7390d5835a5da8679274990bf97
-
SHA1
1e913a8ff85c47b5cc358dd53c5b999f3681512c
-
SHA256
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4
-
SHA512
a8e3bfcf99c2cf3ff908df6d3be744321271c11ca0623e402bf63c3cdc535b954aaa9b3828117e450784cc23057e4f117b595135f50b35c884f16958d8f85ddf
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw86B:Olg35GTslA5t3/w86B
Malware Config
Signatures
-
Processes:
odcinur-ousur.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" odcinur-ousur.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
odcinur-ousur.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\IsInstalled = "1" odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\StubPath = "C:\\Windows\\system32\\ubmupeat-ocom.exe" odcinur-ousur.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245} odcinur-ousur.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
odcinur-ousur.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ebhidob.exe" odcinur-ousur.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" odcinur-ousur.exe -
Executes dropped EXE 2 IoCs
Processes:
odcinur-ousur.exeodcinur-ousur.exepid process 1768 odcinur-ousur.exe 2672 odcinur-ousur.exe -
Loads dropped DLL 3 IoCs
Processes:
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exeodcinur-ousur.exepid process 2276 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe 2276 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe 1768 odcinur-ousur.exe -
Processes:
odcinur-ousur.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" odcinur-ousur.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
odcinur-ousur.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} odcinur-ousur.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\irdoager-ufoas.dll" odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" odcinur-ousur.exe -
Drops file in System32 directory 9 IoCs
Processes:
odcinur-ousur.exed0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ebhidob.exe odcinur-ousur.exe File opened for modification C:\Windows\SysWOW64\ubmupeat-ocom.exe odcinur-ousur.exe File created C:\Windows\SysWOW64\ubmupeat-ocom.exe odcinur-ousur.exe File opened for modification C:\Windows\SysWOW64\irdoager-ufoas.dll odcinur-ousur.exe File opened for modification C:\Windows\SysWOW64\odcinur-ousur.exe d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe File created C:\Windows\SysWOW64\odcinur-ousur.exe d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe File opened for modification C:\Windows\SysWOW64\odcinur-ousur.exe odcinur-ousur.exe File created C:\Windows\SysWOW64\ebhidob.exe odcinur-ousur.exe File created C:\Windows\SysWOW64\irdoager-ufoas.dll odcinur-ousur.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
odcinur-ousur.exeodcinur-ousur.exepid process 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 2672 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe 1768 odcinur-ousur.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exeodcinur-ousur.exedescription pid process Token: SeDebugPrivilege 2276 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe Token: SeDebugPrivilege 1768 odcinur-ousur.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exeodcinur-ousur.exedescription pid process target process PID 2276 wrote to memory of 1768 2276 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe odcinur-ousur.exe PID 2276 wrote to memory of 1768 2276 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe odcinur-ousur.exe PID 2276 wrote to memory of 1768 2276 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe odcinur-ousur.exe PID 2276 wrote to memory of 1768 2276 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe odcinur-ousur.exe PID 1768 wrote to memory of 436 1768 odcinur-ousur.exe winlogon.exe PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 2672 1768 odcinur-ousur.exe odcinur-ousur.exe PID 1768 wrote to memory of 2672 1768 odcinur-ousur.exe odcinur-ousur.exe PID 1768 wrote to memory of 2672 1768 odcinur-ousur.exe odcinur-ousur.exe PID 1768 wrote to memory of 2672 1768 odcinur-ousur.exe odcinur-ousur.exe PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE PID 1768 wrote to memory of 1256 1768 odcinur-ousur.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe"C:\Users\Admin\AppData\Local\Temp\d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\odcinur-ousur.exe"C:\Windows\system32\odcinur-ousur.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\odcinur-ousur.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\ebhidob.exeFilesize
73KB
MD5ae5e44f69a3ba31401785f9dce486ba6
SHA16a51bfeabb814a0946c5ca69bd01a534f64fc53f
SHA256f469ccac44b02567411dd8b5e2b5d586d72ead1d56e93bef94bc412d94a52f08
SHA512e6aa83cd20663273cdb7371612f42592ec448e10cf521e3c95d9b220ca29249b4184b90ca8e518a421ac7f8902629d01f2e3323d315a41fe1079368e8244c0b2
-
C:\Windows\SysWOW64\irdoager-ufoas.dllFilesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
C:\Windows\SysWOW64\ubmupeat-ocom.exeFilesize
72KB
MD5333f420a38ba4707e64ed24352de75ad
SHA1ad6053d28322149a895c97618f983f9104fc0ed8
SHA256ecf3819e2c66086ddf33841eef91dbabfbc7ff13c6f028114f9ee46b3cd67df6
SHA5126d1e877671513b4753567525be142c5ffeca18d5605b817e3ec9f24d32216b08b7d16486aff420917f0eaf837aa76245c69d360c35ae9ea4454eb0fe9257b308
-
\Windows\SysWOW64\odcinur-ousur.exeFilesize
70KB
MD568c8d7390d5835a5da8679274990bf97
SHA11e913a8ff85c47b5cc358dd53c5b999f3681512c
SHA256d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4
SHA512a8e3bfcf99c2cf3ff908df6d3be744321271c11ca0623e402bf63c3cdc535b954aaa9b3828117e450784cc23057e4f117b595135f50b35c884f16958d8f85ddf
-
memory/1768-55-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2276-10-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2672-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB