Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 08:26

General

  • Target

    70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe

  • Size

    225KB

  • MD5

    744c28c76889701b6d77f530ade27be9

  • SHA1

    8fc6e595c8c1db35663885e3fb594e826b693be2

  • SHA256

    70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064

  • SHA512

    09d59a97726c3d87693f8ee2456f8e5667347c9c028cd62fc06a3818f41ef7fc05a0ff72189bced0c1a918ae648c8aae366ec5b318e868bbc287eccb1a2527a5

  • SSDEEP

    3072:osXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwRmyHL:JR5IuMQoseGk7RZBGxAycKpSPX2NHL

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe
    "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
      "C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4408
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe\" arguments" /sc MINUTE /mo 1
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2320
      • \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
        "c:\windows\microsoft.net\framework\v2.0.50727\\InstallUtil.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3684
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      2⤵
        PID:3708
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe.config"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3956
        • C:\Windows\system32\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:2040
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:3212
      • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
        C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe arguments
        1⤵
        • Executes dropped EXE
        PID:1196
      • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe
        C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe arguments
        1⤵
        • Executes dropped EXE
        PID:4036

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\PhoneOm32.exe.log

              Filesize

              595B

              MD5

              5446caf843683ea0aab610c729c40ab1

              SHA1

              6df96e9c6c90843766b0fde8cec5e3a955291e74

              SHA256

              f7dbd089564c22c13483b867392a7bd1f9b49f8e0b089e2cc7bd7bfbf62c6329

              SHA512

              488e2b8750ff820e3fbdcbb9201abddfc6c8ccc3e7cc29962a05c2313ea862eddbf4e0a49ab6a5029aa4d9c137daf2623f1b34e4dcb896269e6edae8276148ff

            • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe

              Filesize

              225KB

              MD5

              dcece638898e47573d0f735f928c528d

              SHA1

              f032007cb4547870962c32eaf59c880bd5de1d2e

              SHA256

              743f10df48eb0b23191ae94bce753d8f99dcfae6b09baa8c17e4527df0ddd29e

              SHA512

              221448a4ca5fe2c851f110266c3c6c688baa2d0d0164e005e226413e0daeb846ec2fed08e1188aa063a81ca99680d05d5cac1276fca9796b913028800394e277

            • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PhoneOm32.exe.config

              Filesize

              1KB

              MD5

              dd3d04c365984b4ec57a80503f81fddf

              SHA1

              c55fbcb61818e47dac9aae465faff91f0805bd7c

              SHA256

              40a59ca9744dc3d4647f246b2dc553f37f8095418c1b48a9bd94cdb5c03dbc5c

              SHA512

              0dd459def2abe9e3f0d1251049a0755c63f7dd3d85e91dba272c3f479f2578e3f3f2379e1cd6913190f7f596af721201eb5d9423ab28aed72bde5cd3cac7f785

            • memory/1196-37-0x0000000000A90000-0x0000000000AB2000-memory.dmp

              Filesize

              136KB

            • memory/3684-31-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

            • memory/4036-42-0x000000001BEA0000-0x000000001BEC2000-memory.dmp

              Filesize

              136KB

            • memory/4408-33-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/4408-28-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/4408-35-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/4408-34-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/4408-32-0x00000000204E0000-0x0000000020542000-memory.dmp

              Filesize

              392KB

            • memory/4408-26-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/4408-30-0x000000001C4A0000-0x000000001C4C2000-memory.dmp

              Filesize

              136KB

            • memory/5044-11-0x000000001EEB0000-0x000000001EF56000-memory.dmp

              Filesize

              664KB

            • memory/5044-3-0x000000001BC20000-0x000000001BCBC000-memory.dmp

              Filesize

              624KB

            • memory/5044-7-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/5044-0-0x00007FFC5AD55000-0x00007FFC5AD56000-memory.dmp

              Filesize

              4KB

            • memory/5044-4-0x0000000001830000-0x0000000001838000-memory.dmp

              Filesize

              32KB

            • memory/5044-29-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/5044-10-0x000000001D820000-0x000000001D842000-memory.dmp

              Filesize

              136KB

            • memory/5044-5-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/5044-9-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/5044-8-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/5044-1-0x00007FFC5AAA0000-0x00007FFC5B441000-memory.dmp

              Filesize

              9.6MB

            • memory/5044-2-0x000000001C240000-0x000000001C70E000-memory.dmp

              Filesize

              4.8MB

            • memory/5044-6-0x000000001C7F0000-0x000000001C856000-memory.dmp

              Filesize

              408KB