Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe
-
Size
72KB
-
MD5
0c537ea2cfe551b0ccca1993e213ab84
-
SHA1
c14146488bdb72b9c1bec5832180925a30bed2ef
-
SHA256
7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54
-
SHA512
d9b88f5be99bb34b6c3e0111ddd9acbd9e510ad252d68b8dd207268471a7331ae1d55c637640cab592de1ca36a3d43863dd1fcfa49e8ee854c4544978c38855e
-
SSDEEP
1536:xUzOORyuTKxBpkcoIOgm5qyrY4xhzO2dsu:a/Kx8DIOvqeY4PzOXu
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ldimot-ugid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ldimot-ugid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ldimot-ugid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ldimot-ugid.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945} ldimot-ugid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ldimot-ugid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\IsInstalled = "1" ldimot-ugid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\StubPath = "C:\\Windows\\system32\\eatginiv-oukeas.exe" ldimot-ugid.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ldimot-ugid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ldimot-ugid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\unpoaxuc-ouded.exe" ldimot-ugid.exe -
Executes dropped EXE 2 IoCs
pid Process 232 ldimot-ugid.exe 4792 ldimot-ugid.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ldimot-ugid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ldimot-ugid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ldimot-ugid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ldimot-ugid.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ldimot-ugid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\smooxoof.dll" ldimot-ugid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ldimot-ugid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ldimot-ugid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ldimot-ugid.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ldimot-ugid.exe 7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe File opened for modification C:\Windows\SysWOW64\unpoaxuc-ouded.exe ldimot-ugid.exe File created C:\Windows\SysWOW64\unpoaxuc-ouded.exe ldimot-ugid.exe File opened for modification C:\Windows\SysWOW64\eatginiv-oukeas.exe ldimot-ugid.exe File opened for modification C:\Windows\SysWOW64\smooxoof.dll ldimot-ugid.exe File created C:\Windows\SysWOW64\smooxoof.dll ldimot-ugid.exe File opened for modification C:\Windows\SysWOW64\ldimot-ugid.exe 7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe File created C:\Windows\SysWOW64\eatginiv-oukeas.exe ldimot-ugid.exe File opened for modification C:\Windows\SysWOW64\ldimot-ugid.exe ldimot-ugid.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 232 ldimot-ugid.exe 232 ldimot-ugid.exe 4792 ldimot-ugid.exe 4792 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe 232 ldimot-ugid.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 232 ldimot-ugid.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 836 wrote to memory of 232 836 7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe 83 PID 836 wrote to memory of 232 836 7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe 83 PID 836 wrote to memory of 232 836 7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe 83 PID 232 wrote to memory of 4792 232 ldimot-ugid.exe 84 PID 232 wrote to memory of 4792 232 ldimot-ugid.exe 84 PID 232 wrote to memory of 4792 232 ldimot-ugid.exe 84 PID 232 wrote to memory of 612 232 ldimot-ugid.exe 5 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56 PID 232 wrote to memory of 3396 232 ldimot-ugid.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe"C:\Users\Admin\AppData\Local\Temp\7da1bdec380053cacabb4b0a26f7cdcf3b9ae560c2ebaf3a33741a1b2892ad54.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\ldimot-ugid.exe"C:\Windows\SysWOW64\ldimot-ugid.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\SysWOW64\ldimot-ugid.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4792
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5bdf81bbaac22e04c6526d57fe5909056
SHA17ddd460959f6c0667d43c7dbc00f166f12b656d2
SHA25624cb2a8fc5c923aa0868cf34e81936eb056862cd8896e97da359caa923eaa08e
SHA5123497a4fb5b9da13b25bd28c16b4502525bdb69e01395273603b3d6789852710d583c3660f7148d37df6766973a3341647044d85bc57ee9dc4f3698402d75998e
-
Filesize
70KB
MD5a88a7eba82f2b47ad987cb6272a9a8b2
SHA1c4c7ffe41d342df5a212e4c561c3e2b3409696a3
SHA25605ffff572239e080e99068f7c051192c042e690678bd7e6e79a019ab94a7d18c
SHA512dcfb3d22e51e10d1992e75a73c3ef8b0745ece8c19a11854a4047693edf21e83942407c161dd89a2b88a40eba702c52a4728972a862a233d1a172a2421194345
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD590ca04756e554a416ea3e2829c5e648a
SHA15853a6727e5b02413242282f4c81157ff21a51f9
SHA256c55f6f49fd012cef832e55add354d272d62bc1d74fd68b9564902fed60e618e5
SHA512c53308f9ae59bfd55562bf15c1f3eb21e75908b4d867d23a0c0803d5425564407099747c6947e401b3f4dea99bf7775b39b11e04c071c366ae2d46b8bf085148