Overview
overview
7Static
static
3OmteLite.exe
windows7-x64
7OmteLite.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
3LICENSE.electron.txt
windows7-x64
1LICENSE.electron.txt
windows10-2004-x64
1chrome_100...nt.pak
windows7-x64
3chrome_100...nt.pak
windows10-2004-x64
3chrome_200...nt.pak
windows7-x64
3chrome_200...nt.pak
windows10-2004-x64
3icudtl.dat
windows7-x64
3icudtl.dat
windows10-2004-x64
3locales/af.pak
windows7-x64
3locales/af.pak
windows10-2004-x64
3locales/am.pak
windows7-x64
3locales/am.pak
windows10-2004-x64
3locales/ar.pak
windows7-x64
3locales/ar.pak
windows10-2004-x64
3locales/bg.pak
windows7-x64
3locales/bg.pak
windows10-2004-x64
3locales/bn.pak
windows7-x64
3locales/bn.pak
windows10-2004-x64
3locales/ca.pak
windows7-x64
3locales/ca.pak
windows10-2004-x64
3locales/cs.pak
windows7-x64
3locales/cs.pak
windows10-2004-x64
3locales/da.pak
windows7-x64
3locales/da.pak
windows10-2004-x64
3Analysis
-
max time kernel
109s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 13:34
Static task
static1
Behavioral task
behavioral1
Sample
OmteLite.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
OmteLite.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
LICENSE.electron.txt
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
LICENSE.electron.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
chrome_100_percent.pak
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
chrome_100_percent.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
chrome_200_percent.pak
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
chrome_200_percent.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
icudtl.dat
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
icudtl.dat
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
locales/af.pak
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
locales/af.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
locales/am.pak
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
locales/am.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
locales/ar.pak
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
locales/ar.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
locales/bg.pak
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
locales/bg.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
locales/bn.pak
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
locales/bn.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
locales/ca.pak
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
locales/ca.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
locales/cs.pak
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
locales/cs.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
locales/da.pak
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
locales/da.pak
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/app-64.7z
-
Size
76.0MB
-
MD5
27553a121fe3f20fa5f6acb2188194ec
-
SHA1
9bf6c3f68ece5a0d8fd61652462a8bb46a41e521
-
SHA256
b8a041027d7f90eb6ed91df36b742f3caacd0fc0687d0b968eb3342f8d8e8e12
-
SHA512
27de4001c09217d966766967fef68f1b02c361d4a8933785ec25b536ade36dc2841c27bcdd736913887efb8348d7352258f3d9cf266a42006aa7854e29c67507
-
SSDEEP
1572864:drziNx5qbJJaoTl9ncU8gKEiPYlkJHo7XiCgo2ck7fT56UaO5UpLVqRij:4x5qbbtTlFdKlYSsXiCgHt6U1upzj
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1352 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1352 AcroRd32.exe 1352 AcroRd32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2300 wrote to memory of 1644 2300 cmd.exe 31 PID 2300 wrote to memory of 1644 2300 cmd.exe 31 PID 2300 wrote to memory of 1644 2300 cmd.exe 31 PID 1644 wrote to memory of 3012 1644 rundll32.exe 32 PID 1644 wrote to memory of 3012 1644 rundll32.exe 32 PID 1644 wrote to memory of 3012 1644 rundll32.exe 32 PID 3012 wrote to memory of 1352 3012 rundll32.exe 34 PID 3012 wrote to memory of 1352 3012 rundll32.exe 34 PID 3012 wrote to memory of 1352 3012 rundll32.exe 34 PID 3012 wrote to memory of 1352 3012 rundll32.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1352
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b66ce176a6eed6751ef9a67c1802a93e
SHA13abfd3bb65a8ffb5865ca2522dcba6f0867f5142
SHA25698f924561b223a9fc6ef76fd3ced3e851c0ef977aa2e4738dc5f637d3783a1a3
SHA5126194dbeb81761c819c592d2d8be547026036dd4c471863047fe147bcdede66f970e2b7e870e0f4fb29beb51fea3dc9e512038eb7bad8de624ca8b1d7f4b53be5