Analysis
-
max time kernel
149s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:21
Static task
static1
Behavioral task
behavioral1
Sample
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe
Resource
win10v2004-20240508-en
General
-
Target
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe
-
Size
70KB
-
MD5
68c8d7390d5835a5da8679274990bf97
-
SHA1
1e913a8ff85c47b5cc358dd53c5b999f3681512c
-
SHA256
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4
-
SHA512
a8e3bfcf99c2cf3ff908df6d3be744321271c11ca0623e402bf63c3cdc535b954aaa9b3828117e450784cc23057e4f117b595135f50b35c884f16958d8f85ddf
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw86B:Olg35GTslA5t3/w86B
Malware Config
Signatures
-
Processes:
odcinur-ousur.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" odcinur-ousur.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
odcinur-ousur.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658} odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\IsInstalled = "1" odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\StubPath = "C:\\Windows\\system32\\ubmupeat-ocom.exe" odcinur-ousur.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
odcinur-ousur.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ebhidob.exe" odcinur-ousur.exe -
Executes dropped EXE 2 IoCs
Processes:
odcinur-ousur.exeodcinur-ousur.exepid process 3924 odcinur-ousur.exe 3820 odcinur-ousur.exe -
Processes:
odcinur-ousur.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" odcinur-ousur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" odcinur-ousur.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
odcinur-ousur.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" odcinur-ousur.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} odcinur-ousur.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" odcinur-ousur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\irdoager-ufoas.dll" odcinur-ousur.exe -
Drops file in System32 directory 9 IoCs
Processes:
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exeodcinur-ousur.exedescription ioc process File opened for modification C:\Windows\SysWOW64\odcinur-ousur.exe d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe File created C:\Windows\SysWOW64\odcinur-ousur.exe d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe File opened for modification C:\Windows\SysWOW64\irdoager-ufoas.dll odcinur-ousur.exe File created C:\Windows\SysWOW64\irdoager-ufoas.dll odcinur-ousur.exe File opened for modification C:\Windows\SysWOW64\odcinur-ousur.exe odcinur-ousur.exe File opened for modification C:\Windows\SysWOW64\ebhidob.exe odcinur-ousur.exe File created C:\Windows\SysWOW64\ebhidob.exe odcinur-ousur.exe File opened for modification C:\Windows\SysWOW64\ubmupeat-ocom.exe odcinur-ousur.exe File created C:\Windows\SysWOW64\ubmupeat-ocom.exe odcinur-ousur.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
odcinur-ousur.exeodcinur-ousur.exepid process 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3820 odcinur-ousur.exe 3820 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe 3924 odcinur-ousur.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exeodcinur-ousur.exedescription pid process Token: SeDebugPrivilege 3380 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe Token: SeDebugPrivilege 3924 odcinur-ousur.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exeodcinur-ousur.exedescription pid process target process PID 3380 wrote to memory of 3924 3380 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe odcinur-ousur.exe PID 3380 wrote to memory of 3924 3380 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe odcinur-ousur.exe PID 3380 wrote to memory of 3924 3380 d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe odcinur-ousur.exe PID 3924 wrote to memory of 3820 3924 odcinur-ousur.exe odcinur-ousur.exe PID 3924 wrote to memory of 3820 3924 odcinur-ousur.exe odcinur-ousur.exe PID 3924 wrote to memory of 3820 3924 odcinur-ousur.exe odcinur-ousur.exe PID 3924 wrote to memory of 616 3924 odcinur-ousur.exe winlogon.exe PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE PID 3924 wrote to memory of 3428 3924 odcinur-ousur.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe"C:\Users\Admin\AppData\Local\Temp\d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\odcinur-ousur.exe"C:\Windows\system32\odcinur-ousur.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\odcinur-ousur.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\ebhidob.exeFilesize
73KB
MD5ca036fc54fbaed836377acc80424f5b8
SHA174cf14ca6ee5bf39bf13df16a586b4c12a62c56c
SHA25665b8fe35f82322d1c439c4172248f504b74dfa922dc5b6dac3ccf8140fbc4f09
SHA512f9aaa370b350bd90c50f7c928fc5ea276bd1dcb26ece5263cac3dec431893a968522771a7e688e5aa5d79feeb248ed28d8560ad7827d5363a586b76abe5a9d2f
-
C:\Windows\SysWOW64\irdoager-ufoas.dllFilesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
C:\Windows\SysWOW64\odcinur-ousur.exeFilesize
70KB
MD568c8d7390d5835a5da8679274990bf97
SHA11e913a8ff85c47b5cc358dd53c5b999f3681512c
SHA256d0f5d2c34f5b3ded6ec0647f03af837579cd408a4dc5b7b98136164ab37515d4
SHA512a8e3bfcf99c2cf3ff908df6d3be744321271c11ca0623e402bf63c3cdc535b954aaa9b3828117e450784cc23057e4f117b595135f50b35c884f16958d8f85ddf
-
C:\Windows\SysWOW64\ubmupeat-ocom.exeFilesize
72KB
MD5239d9f85e0d428a4e4363919e952885d
SHA18f5d532d5b109ab3889eac8dbf483973b22ed347
SHA256c776becdb93ef1d7304924537f26fdc407140412416a4e4fdc17c1a17ba65c38
SHA512056298018d13dc10bf2cb40c40ad468423d2bc57ed06926ade4d09677fe5c35aa26c01052d0f22f92da3cecb0fc66de7669e2ca7e480eb24e5dc637acb6abbd6
-
memory/3380-4-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3820-50-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3924-49-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB