Malware Analysis Report

2024-11-15 07:14

Sample ID 241108-ta497svfmm
Target ida-pro_90_x64win.exe
SHA256 e24ae161a8a9d2edde04149c270db3509cb1056841bed0763ae167902f160c9c
Tags
discovery evasion trojan
score
4/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
4/10

SHA256

e24ae161a8a9d2edde04149c270db3509cb1056841bed0763ae167902f160c9c

Threat Level: Likely benign

The file ida-pro_90_x64win.exe was found to be: Likely benign.

Malicious Activity Summary

discovery evasion trojan

Loads dropped DLL

Checks whether UAC is enabled

System Location Discovery: System Language Discovery

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 15:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 15:52

Reported

2024-11-08 16:02

Platform

win7-20241010-en

Max time kernel

142s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe"

Signatures

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe

"C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\BRL000007fc\BRA5D.tmp

MD5 99b50db8d177a51b7077084bb75673b5
SHA1 ff68863631241c2159cecdd03f5101e628b25bf7
SHA256 09db806002dd23cf97d5b8057a792fc90d11fe5c595f63f92f5c4494b33cbc6f
SHA512 fc5b6d06f95fedfbd929ecb2ed5f86cd0fd797140b54be29b23c8096925c3025504d0613f85ea4c2f0e459b8cd59dba22395c8348801a332d6595bd83d87d4e0

\Users\Admin\AppData\Local\Temp\BRL000007fc\BRB19.tmp

MD5 122a3741699fb5c0950273245c9dea15
SHA1 811f9149e3310a8e6521da156f92f3aaab012145
SHA256 f675eba3b22e0a2238ec4961d99de3bacca0ab553ab26eecb49800a12a9371ab
SHA512 567c480f70fdc78769ae45bf83b6632f7ab380ebeb00689028d39ff03840c8b778149a3fafe1dab2ac77a1fd17a23b09f58774b1c5e791bfd33b99528225eccc

\Users\Admin\AppData\Local\Temp\BRL000007fc\BRBC6.tmp

MD5 08ad4cd2a940379f1dcdbdb9884a1375
SHA1 c302b7589ba4f05c6429e7f89ad0cb84dd9dfbac
SHA256 78827e2b1ef0aad4f8b1b42d0964064819aa22bfcd537ebaacb30d817edc06d8
SHA512 f37bd071994c31b361090a149999e8b2d4a7839f19ea63e1d4563aada1371be37f2bfcc474e24de95ff77ca4124a39580c9f711e2fbe54265713ab76f631835a

\Users\Admin\AppData\Local\Temp\BRL000007fc\BRC24.tmp

MD5 2f427b95ab4d18e83f89a001c6b861ad
SHA1 56d10658f71f102961ebc334d277728025d01cdf
SHA256 00ec351fd1e77bcb5bf452b9e8dc5b386c65d74d02815b0adebb70fb57db5416
SHA512 ebe0b9ca89c2ac2e70d23043b495a21d5c29b5e22ee458641119b7394ac307ae50cc2f636fc409ddbb2039361547106961dabcae0c123055c315f8f900074d97

\Users\Admin\AppData\Local\Temp\BRL000007fc\BRC73.tmp

MD5 a6f7a08b0676f0564a51b5c47973e635
SHA1 d56f5f9e2580b81717317da6582da9d379426d5b
SHA256 5dd27e845af9333ad7b907a37ab3d239b75be6ccc1f51ef4b21e59b037ce778c
SHA512 1101813034db327af1c16d069a4dfa91ab97ee8188f9ed1a6da9d25558866e7e9af59102e58127e64441d3e4a768b2ad788fd0e5a16db994a14637bfbade2954

\Users\Admin\AppData\Local\Temp\BRL000007fc\BRCC2.tmp

MD5 c04970b55bcf614f24ca75b1de641ae2
SHA1 52b182caef513ed1c36f28eb45cedb257fa8ce40
SHA256 5ddee4aab3cf33e505f52199d64809125b26de04fb9970ca589cd8619c859d80
SHA512 a5f2660e336bf74a1936fb2e1c724220d862632907f5fd690b365009ac3e1bf35fa6689071f3da4049e495f340ff83f8438b79079ef1f248b9dcaedbdd5d3e40

\Users\Admin\AppData\Local\Temp\BRL000007fc\BRCF2.tmp

MD5 77fe66d74901495f4b41a5918acd02ff
SHA1 ce5bbd53152cd5b03df8bcc232a1aea36a012764
SHA256 b017168c69ef40115141813e47122391602e1af28af342c56495b09f1c3c7522
SHA512 cc6e323d0076577a0a04dbe2c33d90dc616cb5ec3637d3df67cbf169766ca2e6de567fcff4f32938fd6118d98e4796642a3010b7264f0ae247fa8f0fe079bd70

\Users\Admin\AppData\Local\Temp\BRL000007fc\BRDFC.tmp

MD5 d74aadd701bfacc474c431acab7b9265
SHA1 8a2b424d1f949430ddc1faddee3e9ccb79c95de2
SHA256 f1029f5cca3dabfeffe2c9db6ad84a9ff0f64f5b2fb85cb6ab348740f756e07d
SHA512 0ef85e311fb4843997fd5f87f0a2eec9715e26eae76bfb7bb701d8c043720aeaf7f4825d25187bf35e0a9f00def15ed071120128805445f1330c07c3e0ea5ced

\Users\Admin\AppData\Local\Temp\BRL000007fc\BR1010.tmp

MD5 924b90c3d9e645dfad53f61ea4e91942
SHA1 65d397199ff191e5078095036e49f08376f9ae4e
SHA256 41788435f245133ec5511111e2c5d52f7515e359876180067e0b5ba85c729322
SHA512 76833708828c8f3fad941abeea158317aff98cf0691b5d5dfa4bca15279cdad1cc23a771258e4de41cf12a58f7033a3ee08b0b5eb834d22be568ea98b183ccd9

\Users\Admin\AppData\Local\Temp\BRL000007fc\BR1030.tmp

MD5 78de24eb7826b1338849ff0348a7e82b
SHA1 03080b8f1c9a7a46951d35f8623ed39c4ba4f722
SHA256 5101c472779b552f3ce044bc2542f726068d914c0d396c8dc1d99ec1aab80767
SHA512 f24ec06717cfbe0d2fcc4ce591b6b5161183c8f62a2db0a43512c676fa1345ddab397f7db6f612c4587ab431274d56bba58c71943afbf60276e45d404429ff64

\Users\Admin\AppData\Local\Temp\BRL000007fc\BR109E.tmp

MD5 4cf27e0747e5719a5478aa2624f6b996
SHA1 13df901e34f77e5ea11f36c0afedda7f86a2c003
SHA256 e69a9d06f2c17cc021ebf9b62ca110548facdc147b67dea4846e09865043d2d9
SHA512 4b0ddcbd7321128f977e1dbbe18cc76c7e489d4ee84b7775989e99778b5a60daa683c6063c5b700794b7f2070ae381fef20b19b3cb35c1babef9be79ff264941

\Users\Admin\AppData\Local\Temp\BRL000007fc\BR10AF.tmp

MD5 124e89d0fcc409ede3595a253b788708
SHA1 bc88e037c3edea02dd20aeff10818105be9f4033
SHA256 27ea1b57a3024aec4a03188e80fdb2aa301fa5179c19be9c8b0dfc2aac73a114
SHA512 7cd0ca268a5dbd2aa22dbce1f253a2d067ca30c5195e059c3f431d546a20d1811592f8bd8fe88b6ad9cb5c6fdd6a4666ff451b84a5e790a9d5058865d48790b1

\Users\Admin\AppData\Local\Temp\BRL000007fc\BR10BF.tmp

MD5 606f13d4d580b1f322b3f3d3df423bba
SHA1 02cb375e13b415edc8b5360dffdba531e47827ed
SHA256 c71a16b1056e522cd0365449448116d06f37a3273d77694d170340064511dd25
SHA512 867a45dc15e99148f24fc528fbc9255582e5534bb4696700292b70163fddb15f35ddf2acd0536a9cd78b4d8f9d827bf7530d2303bfd7e428f11573b381a0986c

memory/2044-57-0x00000000004E0000-0x00000000004F9000-memory.dmp

\Users\Admin\AppData\Local\Temp\BRL000007fc\BR10EF.tmp

MD5 145d5c49fe34a44662beaffe641d58c7
SHA1 95d5e92523990b614125d66fa3fa395170a73bfe
SHA256 59182f092b59a3005ada6b2f2855c7e860e53e8adf6e41cd8cd515578ae7815a
SHA512 48cb0048f4fcf460e791a5b0beca40dbf2399b70f1784236b6d1f17835201d70dfa64c498814b872f57e527793c58a5959230fe40ddf5ebdcb0b1de57e9c53ef

memory/2044-63-0x0000000000490000-0x000000000049E000-memory.dmp

memory/2044-71-0x0000000075110000-0x000000007511B000-memory.dmp

memory/2044-74-0x0000000067E00000-0x0000000067E1B000-memory.dmp

memory/2044-73-0x0000000066C00000-0x0000000066C14000-memory.dmp

memory/2044-72-0x0000000066C40000-0x0000000066C4B000-memory.dmp

memory/2044-70-0x0000000067C80000-0x0000000067D0C000-memory.dmp

memory/2044-69-0x00000000710C0000-0x00000000710DF000-memory.dmp

memory/2044-68-0x0000000066680000-0x000000006668E000-memory.dmp

memory/2044-67-0x00000000756B0000-0x00000000756BE000-memory.dmp

memory/2044-66-0x0000000000A50000-0x0000000000D23000-memory.dmp

memory/2044-75-0x0000000000A50000-0x0000000000D23000-memory.dmp

memory/2044-84-0x0000000000A50000-0x0000000000D23000-memory.dmp

memory/2044-93-0x0000000000A50000-0x0000000000D23000-memory.dmp

memory/2044-102-0x0000000000A50000-0x0000000000D23000-memory.dmp

memory/2044-111-0x0000000000A50000-0x0000000000D23000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-08 15:52

Reported

2024-11-08 16:01

Platform

win10v2004-20241007-en

Max time kernel

151s

Max time network

172s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe"

Signatures

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe

"C:\Users\Admin\AppData\Local\Temp\ida-pro_90_x64win.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFBB5.tmp

MD5 99b50db8d177a51b7077084bb75673b5
SHA1 ff68863631241c2159cecdd03f5101e628b25bf7
SHA256 09db806002dd23cf97d5b8057a792fc90d11fe5c595f63f92f5c4494b33cbc6f
SHA512 fc5b6d06f95fedfbd929ecb2ed5f86cd0fd797140b54be29b23c8096925c3025504d0613f85ea4c2f0e459b8cd59dba22395c8348801a332d6595bd83d87d4e0

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFC04.tmp

MD5 122a3741699fb5c0950273245c9dea15
SHA1 811f9149e3310a8e6521da156f92f3aaab012145
SHA256 f675eba3b22e0a2238ec4961d99de3bacca0ab553ab26eecb49800a12a9371ab
SHA512 567c480f70fdc78769ae45bf83b6632f7ab380ebeb00689028d39ff03840c8b778149a3fafe1dab2ac77a1fd17a23b09f58774b1c5e791bfd33b99528225eccc

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFC73.tmp

MD5 08ad4cd2a940379f1dcdbdb9884a1375
SHA1 c302b7589ba4f05c6429e7f89ad0cb84dd9dfbac
SHA256 78827e2b1ef0aad4f8b1b42d0964064819aa22bfcd537ebaacb30d817edc06d8
SHA512 f37bd071994c31b361090a149999e8b2d4a7839f19ea63e1d4563aada1371be37f2bfcc474e24de95ff77ca4124a39580c9f711e2fbe54265713ab76f631835a

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFC93.tmp

MD5 2f427b95ab4d18e83f89a001c6b861ad
SHA1 56d10658f71f102961ebc334d277728025d01cdf
SHA256 00ec351fd1e77bcb5bf452b9e8dc5b386c65d74d02815b0adebb70fb57db5416
SHA512 ebe0b9ca89c2ac2e70d23043b495a21d5c29b5e22ee458641119b7394ac307ae50cc2f636fc409ddbb2039361547106961dabcae0c123055c315f8f900074d97

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFCA4.tmp

MD5 a6f7a08b0676f0564a51b5c47973e635
SHA1 d56f5f9e2580b81717317da6582da9d379426d5b
SHA256 5dd27e845af9333ad7b907a37ab3d239b75be6ccc1f51ef4b21e59b037ce778c
SHA512 1101813034db327af1c16d069a4dfa91ab97ee8188f9ed1a6da9d25558866e7e9af59102e58127e64441d3e4a768b2ad788fd0e5a16db994a14637bfbade2954

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFCD4.tmp

MD5 c04970b55bcf614f24ca75b1de641ae2
SHA1 52b182caef513ed1c36f28eb45cedb257fa8ce40
SHA256 5ddee4aab3cf33e505f52199d64809125b26de04fb9970ca589cd8619c859d80
SHA512 a5f2660e336bf74a1936fb2e1c724220d862632907f5fd690b365009ac3e1bf35fa6689071f3da4049e495f340ff83f8438b79079ef1f248b9dcaedbdd5d3e40

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFCE4.tmp

MD5 77fe66d74901495f4b41a5918acd02ff
SHA1 ce5bbd53152cd5b03df8bcc232a1aea36a012764
SHA256 b017168c69ef40115141813e47122391602e1af28af342c56495b09f1c3c7522
SHA512 cc6e323d0076577a0a04dbe2c33d90dc616cb5ec3637d3df67cbf169766ca2e6de567fcff4f32938fd6118d98e4796642a3010b7264f0ae247fa8f0fe079bd70

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFD62.tmp

MD5 d74aadd701bfacc474c431acab7b9265
SHA1 8a2b424d1f949430ddc1faddee3e9ccb79c95de2
SHA256 f1029f5cca3dabfeffe2c9db6ad84a9ff0f64f5b2fb85cb6ab348740f756e07d
SHA512 0ef85e311fb4843997fd5f87f0a2eec9715e26eae76bfb7bb701d8c043720aeaf7f4825d25187bf35e0a9f00def15ed071120128805445f1330c07c3e0ea5ced

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFE7C.tmp

MD5 924b90c3d9e645dfad53f61ea4e91942
SHA1 65d397199ff191e5078095036e49f08376f9ae4e
SHA256 41788435f245133ec5511111e2c5d52f7515e359876180067e0b5ba85c729322
SHA512 76833708828c8f3fad941abeea158317aff98cf0691b5d5dfa4bca15279cdad1cc23a771258e4de41cf12a58f7033a3ee08b0b5eb834d22be568ea98b183ccd9

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFE7D.tmp

MD5 78de24eb7826b1338849ff0348a7e82b
SHA1 03080b8f1c9a7a46951d35f8623ed39c4ba4f722
SHA256 5101c472779b552f3ce044bc2542f726068d914c0d396c8dc1d99ec1aab80767
SHA512 f24ec06717cfbe0d2fcc4ce591b6b5161183c8f62a2db0a43512c676fa1345ddab397f7db6f612c4587ab431274d56bba58c71943afbf60276e45d404429ff64

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFECD.tmp

MD5 4cf27e0747e5719a5478aa2624f6b996
SHA1 13df901e34f77e5ea11f36c0afedda7f86a2c003
SHA256 e69a9d06f2c17cc021ebf9b62ca110548facdc147b67dea4846e09865043d2d9
SHA512 4b0ddcbd7321128f977e1dbbe18cc76c7e489d4ee84b7775989e99778b5a60daa683c6063c5b700794b7f2070ae381fef20b19b3cb35c1babef9be79ff264941

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFECE.tmp

MD5 124e89d0fcc409ede3595a253b788708
SHA1 bc88e037c3edea02dd20aeff10818105be9f4033
SHA256 27ea1b57a3024aec4a03188e80fdb2aa301fa5179c19be9c8b0dfc2aac73a114
SHA512 7cd0ca268a5dbd2aa22dbce1f253a2d067ca30c5195e059c3f431d546a20d1811592f8bd8fe88b6ad9cb5c6fdd6a4666ff451b84a5e790a9d5058865d48790b1

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFECF.tmp

MD5 606f13d4d580b1f322b3f3d3df423bba
SHA1 02cb375e13b415edc8b5360dffdba531e47827ed
SHA256 c71a16b1056e522cd0365449448116d06f37a3273d77694d170340064511dd25
SHA512 867a45dc15e99148f24fc528fbc9255582e5534bb4696700292b70163fddb15f35ddf2acd0536a9cd78b4d8f9d827bf7530d2303bfd7e428f11573b381a0986c

C:\Users\Admin\AppData\Local\Temp\BRL00000e34\BRFEDF.tmp

MD5 145d5c49fe34a44662beaffe641d58c7
SHA1 95d5e92523990b614125d66fa3fa395170a73bfe
SHA256 59182f092b59a3005ada6b2f2855c7e860e53e8adf6e41cd8cd515578ae7815a
SHA512 48cb0048f4fcf460e791a5b0beca40dbf2399b70f1784236b6d1f17835201d70dfa64c498814b872f57e527793c58a5959230fe40ddf5ebdcb0b1de57e9c53ef

memory/3636-77-0x0000000000F90000-0x0000000000F9E000-memory.dmp

memory/3636-69-0x00000000009E0000-0x00000000009F9000-memory.dmp

memory/3636-82-0x0000000066680000-0x000000006668E000-memory.dmp

memory/3636-88-0x0000000067E00000-0x0000000067E1B000-memory.dmp

memory/3636-87-0x0000000066C00000-0x0000000066C14000-memory.dmp

memory/3636-86-0x0000000066C40000-0x0000000066C4B000-memory.dmp

memory/3636-85-0x0000000075160000-0x000000007516B000-memory.dmp

memory/3636-84-0x0000000067C80000-0x0000000067D0C000-memory.dmp

memory/3636-83-0x00000000710C0000-0x00000000710DF000-memory.dmp

memory/3636-80-0x0000000000590000-0x0000000000863000-memory.dmp

memory/3636-81-0x00000000754A0000-0x00000000754AE000-memory.dmp

memory/3636-89-0x0000000000590000-0x0000000000863000-memory.dmp

memory/3636-98-0x0000000000590000-0x0000000000863000-memory.dmp

memory/3636-107-0x0000000000590000-0x0000000000863000-memory.dmp

memory/3636-116-0x0000000000590000-0x0000000000863000-memory.dmp

memory/3636-125-0x0000000000590000-0x0000000000863000-memory.dmp