Analysis
-
max time kernel
115s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 17:12
Static task
static1
Behavioral task
behavioral1
Sample
7604c20a3857ff7a19951bd340c12820N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7604c20a3857ff7a19951bd340c12820N.exe
Resource
win10v2004-20240802-en
General
-
Target
7604c20a3857ff7a19951bd340c12820N.exe
-
Size
256KB
-
MD5
7604c20a3857ff7a19951bd340c12820
-
SHA1
b1f4b4c30fb4abd46b58c45895e9b96faca4b0cd
-
SHA256
96e519c2c1cd14af4e4c77c9c9483ff6db857721173a5d0eb7e18453c8db8c8f
-
SHA512
4f4d6829f6daf92abf43617a2527208da280866a8f5c45070c2320435d5d6d16ad5dcfb004d3fe58de0e2fe9dad2b0441cfa55158e819ce0e8c9f85fb72ec339
-
SSDEEP
6144:rT4cDsZ853XBpnTfwNPbAvjDAcXxxXfY09cnEWPDZj:rTGQBpnchWcZj
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daekdooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Daekdooc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dddhpjof.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 7604c20a3857ff7a19951bd340c12820N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 7604c20a3857ff7a19951bd340c12820N.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddakjkqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddakjkqi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dddhpjof.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhocqigp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhocqigp.exe -
Executes dropped EXE 6 IoCs
pid Process 3972 Ddakjkqi.exe 3620 Dogogcpo.exe 3732 Daekdooc.exe 5036 Dddhpjof.exe 4588 Dhocqigp.exe 4784 Dmllipeg.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dogogcpo.exe Ddakjkqi.exe File opened for modification C:\Windows\SysWOW64\Dogogcpo.exe Ddakjkqi.exe File created C:\Windows\SysWOW64\Daekdooc.exe Dogogcpo.exe File created C:\Windows\SysWOW64\Lbabpnmn.dll Ddakjkqi.exe File opened for modification C:\Windows\SysWOW64\Daekdooc.exe Dogogcpo.exe File created C:\Windows\SysWOW64\Amjknl32.dll Daekdooc.exe File created C:\Windows\SysWOW64\Elkadb32.dll Dddhpjof.exe File created C:\Windows\SysWOW64\Dmllipeg.exe Dhocqigp.exe File created C:\Windows\SysWOW64\Kngpec32.dll Dhocqigp.exe File created C:\Windows\SysWOW64\Ddakjkqi.exe 7604c20a3857ff7a19951bd340c12820N.exe File created C:\Windows\SysWOW64\Dddhpjof.exe Daekdooc.exe File created C:\Windows\SysWOW64\Dhocqigp.exe Dddhpjof.exe File opened for modification C:\Windows\SysWOW64\Dhocqigp.exe Dddhpjof.exe File opened for modification C:\Windows\SysWOW64\Dmllipeg.exe Dhocqigp.exe File opened for modification C:\Windows\SysWOW64\Ddakjkqi.exe 7604c20a3857ff7a19951bd340c12820N.exe File created C:\Windows\SysWOW64\Gifhkeje.dll 7604c20a3857ff7a19951bd340c12820N.exe File created C:\Windows\SysWOW64\Ohmoom32.dll Dogogcpo.exe File opened for modification C:\Windows\SysWOW64\Dddhpjof.exe Daekdooc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 748 4784 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dogogcpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daekdooc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dddhpjof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhocqigp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dmllipeg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7604c20a3857ff7a19951bd340c12820N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ddakjkqi.exe -
Modifies registry class 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddakjkqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll" Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkadb32.dll" Dddhpjof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 7604c20a3857ff7a19951bd340c12820N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Daekdooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Daekdooc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dogogcpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll" Daekdooc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dhocqigp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll" 7604c20a3857ff7a19951bd340c12820N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddakjkqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll" Ddakjkqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 7604c20a3857ff7a19951bd340c12820N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dogogcpo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dddhpjof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dddhpjof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll" Dhocqigp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 7604c20a3857ff7a19951bd340c12820N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 7604c20a3857ff7a19951bd340c12820N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 7604c20a3857ff7a19951bd340c12820N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dhocqigp.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2540 wrote to memory of 3972 2540 7604c20a3857ff7a19951bd340c12820N.exe 84 PID 2540 wrote to memory of 3972 2540 7604c20a3857ff7a19951bd340c12820N.exe 84 PID 2540 wrote to memory of 3972 2540 7604c20a3857ff7a19951bd340c12820N.exe 84 PID 3972 wrote to memory of 3620 3972 Ddakjkqi.exe 85 PID 3972 wrote to memory of 3620 3972 Ddakjkqi.exe 85 PID 3972 wrote to memory of 3620 3972 Ddakjkqi.exe 85 PID 3620 wrote to memory of 3732 3620 Dogogcpo.exe 86 PID 3620 wrote to memory of 3732 3620 Dogogcpo.exe 86 PID 3620 wrote to memory of 3732 3620 Dogogcpo.exe 86 PID 3732 wrote to memory of 5036 3732 Daekdooc.exe 87 PID 3732 wrote to memory of 5036 3732 Daekdooc.exe 87 PID 3732 wrote to memory of 5036 3732 Daekdooc.exe 87 PID 5036 wrote to memory of 4588 5036 Dddhpjof.exe 88 PID 5036 wrote to memory of 4588 5036 Dddhpjof.exe 88 PID 5036 wrote to memory of 4588 5036 Dddhpjof.exe 88 PID 4588 wrote to memory of 4784 4588 Dhocqigp.exe 90 PID 4588 wrote to memory of 4784 4588 Dhocqigp.exe 90 PID 4588 wrote to memory of 4784 4588 Dhocqigp.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\7604c20a3857ff7a19951bd340c12820N.exe"C:\Users\Admin\AppData\Local\Temp\7604c20a3857ff7a19951bd340c12820N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\Ddakjkqi.exeC:\Windows\system32\Ddakjkqi.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\Dogogcpo.exeC:\Windows\system32\Dogogcpo.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\Daekdooc.exeC:\Windows\system32\Daekdooc.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\Dddhpjof.exeC:\Windows\system32\Dddhpjof.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\Dhocqigp.exeC:\Windows\system32\Dhocqigp.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\Dmllipeg.exeC:\Windows\system32\Dmllipeg.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 4048⤵
- Program crash
PID:748
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4784 -ip 47841⤵PID:5012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5096134644ab14f9f3b7e3cef944cd03b
SHA1df71f24771899e5944b91963f574697af948a8cf
SHA256974fed52b480e3085e544c39f769c31f4bca47229dd8b6930c84e3f60c900428
SHA5124c22456ae50236042643478b9f6ee3cc543a55b1a3e04cca8a6288d746fc7870ae72ef8126bf961e9b8a5c6b9ec443fb87dbeb5b55b2f27b8a6deb1725f5d6bf
-
Filesize
256KB
MD56115271333a5885277a6699a889a6662
SHA1581aee8eef8021352ece33f47c1ed52b5f0e78e8
SHA2565d702a0be708f3ff690df732432ac5f06dd83030956a51b6c816c0b0593d4359
SHA51221b7dd7ce1886eb30327416ab52c698515d301d0f6e4a2919717dc56b6dd79e5df05de9e17c70a118bd9a51afdecf570d8c3898986ee5b34c9747140a42630dd
-
Filesize
256KB
MD549fb2a8a5b0dba2be851235aa12806be
SHA1b4d684c4a9fc4f3ae4b6ccba0a3faa0958afe32b
SHA2569029a48caea07094acecf4a9206d24c27b3d0ece70afb9c19a3daf689d53826f
SHA51286ed18c273559a68fbcb3e0ca2f3de931407573f5f738e6a94caf6f5b4dab229a139556352ea8da40ce12c2340899c0fc22608b907b125a473bac5d4505e2ac8
-
Filesize
256KB
MD59948cf51e4b34f35bc335afe08631159
SHA1fdf506e567e34a155ef08f0197b250a6fc2236c4
SHA2569f759b9803704de2b1e52f3f088ac98e0527d1c02840f489fa0ee00abfe2565d
SHA51284c086159c7ef6fcbc456d34ede972b59235ae138374acdb08cd21d35d07f41113533c55c6229ac88bc3509b88ffb1ef64e30b0fc3ff2062f1037c350fa1225c
-
Filesize
256KB
MD5fd4b345294abc105acc2720797005553
SHA10b4558d66507dbd382025729eccae363b89d49f0
SHA256eeb1e4d6f93d9f89c5032193431ffad5d7cc672b30fa9836bedc8daad3209f26
SHA5128429f08358ff87f43b924dc760b672ccaa845f970bb1e778f89f9ab58fbd85eaf4a74b70816daf96323db6b5f41bc38c5f0db298f795294681526d0832883562
-
Filesize
256KB
MD5c3f74bc6f2472c32388714a987fd4d91
SHA1292e139681ed9f37d153b2e7dcb780c7a30b07d7
SHA256e3685cda74af9c69541069c47bc6e2c782760a704f8c6eb32736236549511dbb
SHA51291eadc593576bfe557f0ef246bf0f4292a3b38520858a5d56766c7deb862621209fed3f8bde7bbb3bd262af2b6b14381eaa3695a81d2fc0d541db4c06f072f25