Analysis
-
max time kernel
110s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 00:30
Static task
static1
Behavioral task
behavioral1
Sample
8462dc4bccc101e5fb88c78cddf36ec0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8462dc4bccc101e5fb88c78cddf36ec0N.exe
Resource
win10v2004-20240802-en
General
-
Target
8462dc4bccc101e5fb88c78cddf36ec0N.exe
-
Size
207KB
-
MD5
8462dc4bccc101e5fb88c78cddf36ec0
-
SHA1
79cd10028e44f7ec01553368efa0fd29a52868a4
-
SHA256
611eafb176c5e29c167223ceb0ec388b7622f0b8b0735ca8dd7fb162aff40894
-
SHA512
5f5939c5106f0c532da47687b12635f9bebc2bbf1dd80b9dd1bc1ebdfdda5da8c36fc1a6eb85d76b72b4a9070eea89e8292e4455f2a18371975eaa23b4f9e2cd
-
SSDEEP
3072:5cgjTfMpY1GJDhxY2lVjoSdoxx4KcWmjRrzyAyAtWgoJSWYVo2ASOvojoS:PHfwY2lVjj+VPj92d62ASOwj
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 8462dc4bccc101e5fb88c78cddf36ec0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" 8462dc4bccc101e5fb88c78cddf36ec0N.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Niikceid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Niikceid.exe -
Executes dropped EXE 2 IoCs
pid Process 2936 Niikceid.exe 2892 Nlhgoqhh.exe -
Loads dropped DLL 8 IoCs
pid Process 2728 8462dc4bccc101e5fb88c78cddf36ec0N.exe 2728 8462dc4bccc101e5fb88c78cddf36ec0N.exe 2936 Niikceid.exe 2936 Niikceid.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe 2628 WerFault.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lamajm32.dll Niikceid.exe File created C:\Windows\SysWOW64\Niikceid.exe 8462dc4bccc101e5fb88c78cddf36ec0N.exe File opened for modification C:\Windows\SysWOW64\Niikceid.exe 8462dc4bccc101e5fb88c78cddf36ec0N.exe File created C:\Windows\SysWOW64\Dnlbnp32.dll 8462dc4bccc101e5fb88c78cddf36ec0N.exe File created C:\Windows\SysWOW64\Nlhgoqhh.exe Niikceid.exe File opened for modification C:\Windows\SysWOW64\Nlhgoqhh.exe Niikceid.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2628 2892 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8462dc4bccc101e5fb88c78cddf36ec0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Niikceid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlhgoqhh.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 8462dc4bccc101e5fb88c78cddf36ec0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lamajm32.dll" Niikceid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 8462dc4bccc101e5fb88c78cddf36ec0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} 8462dc4bccc101e5fb88c78cddf36ec0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnlbnp32.dll" 8462dc4bccc101e5fb88c78cddf36ec0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Niikceid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 8462dc4bccc101e5fb88c78cddf36ec0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 8462dc4bccc101e5fb88c78cddf36ec0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Niikceid.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2936 2728 8462dc4bccc101e5fb88c78cddf36ec0N.exe 30 PID 2728 wrote to memory of 2936 2728 8462dc4bccc101e5fb88c78cddf36ec0N.exe 30 PID 2728 wrote to memory of 2936 2728 8462dc4bccc101e5fb88c78cddf36ec0N.exe 30 PID 2728 wrote to memory of 2936 2728 8462dc4bccc101e5fb88c78cddf36ec0N.exe 30 PID 2936 wrote to memory of 2892 2936 Niikceid.exe 31 PID 2936 wrote to memory of 2892 2936 Niikceid.exe 31 PID 2936 wrote to memory of 2892 2936 Niikceid.exe 31 PID 2936 wrote to memory of 2892 2936 Niikceid.exe 31 PID 2892 wrote to memory of 2628 2892 Nlhgoqhh.exe 32 PID 2892 wrote to memory of 2628 2892 Nlhgoqhh.exe 32 PID 2892 wrote to memory of 2628 2892 Nlhgoqhh.exe 32 PID 2892 wrote to memory of 2628 2892 Nlhgoqhh.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\8462dc4bccc101e5fb88c78cddf36ec0N.exe"C:\Users\Admin\AppData\Local\Temp\8462dc4bccc101e5fb88c78cddf36ec0N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\Niikceid.exeC:\Windows\system32\Niikceid.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\Nlhgoqhh.exeC:\Windows\system32\Nlhgoqhh.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 1404⤵
- Loads dropped DLL
- Program crash
PID:2628
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD577b5beb76133b2a67a9227655e997939
SHA14889b0310db2ed408609e8a30d8af3a7b5de307d
SHA256f603ee6143e7a3c8bf1af0fa920b95c3dcf5af80ed2eaec8e28fe76e55bd6da4
SHA512ea932438218c6ae44043e77a8016dc1ae16d0bfeb0e6aab4d0ee5b2228149a14891a095f20790d8a78093cd8d15cd0beefe7b082eb2cae3e178c250b4936b048
-
Filesize
207KB
MD5e501c8e91e3bd8e42f34a05c748b1fcf
SHA16289c032bf1a39fd8920b778ec05f01f9fc098ec
SHA2560f15981b9f1800f32b7ac7f8932c0319ef5d32eee5d4504c3714cfd73bf3f525
SHA512ad908035013f653fd3ca779e917687c2c7411da7c6ce0fa32770370eb5293a8b2187cf90acc2157e7c79a08d453e4a077591f8e002fcacf2babfc05a5882bc20