Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 12:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe
-
Size
36KB
-
MD5
1e7e657e12560c3b7d950001a38cc8b1
-
SHA1
675d1cce2c0125f37871faa9dccc423f72a9a882
-
SHA256
f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab
-
SHA512
a41e1b7ec27b74fc5ae6a6057d1cf56ebf658bfccecc7e0cfd68b9aa1d36b9141f0765d612b7f367f5f5e74d4964c3323c7f3a05cd7eb728cadb9387cd836abb
-
SSDEEP
768:sIUmhCfRKfmrEhjR2cS5fzWbAGO8azppk9SNKGCc:sAhCZKfmrqjRu5fibAF8qYSNKhc
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" udloavak-acur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" udloavak-acur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" udloavak-acur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" udloavak-acur.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{564F5248-5042-4142-564F-524850424142} udloavak-acur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{564F5248-5042-4142-564F-524850424142}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" udloavak-acur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{564F5248-5042-4142-564F-524850424142}\IsInstalled = "1" udloavak-acur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{564F5248-5042-4142-564F-524850424142}\StubPath = "C:\\Windows\\system32\\uhnugead-oudat.exe" udloavak-acur.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe udloavak-acur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" udloavak-acur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ogpopem-ousooc.exe" udloavak-acur.exe -
Executes dropped EXE 2 IoCs
pid Process 616 udloavak-acur.exe 2440 udloavak-acur.exe -
Loads dropped DLL 3 IoCs
pid Process 1980 f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe 1980 f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe 616 udloavak-acur.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" udloavak-acur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" udloavak-acur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" udloavak-acur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" udloavak-acur.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger udloavak-acur.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\thivom.dll" udloavak-acur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" udloavak-acur.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} udloavak-acur.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify udloavak-acur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" udloavak-acur.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\aset32.exe udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\gymspzd.dll udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\udloavak-acur.exe udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\uhnugead-oudat.exe udloavak-acur.exe File created C:\Windows\SysWOW64\uhnugead-oudat.exe udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\udloavak-acur.exe f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe File created C:\Windows\SysWOW64\udloavak-acur.exe f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe File created C:\Windows\SysWOW64\thivom.dll udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\ogpopem-ousooc.exe udloavak-acur.exe File created C:\Windows\SysWOW64\ogpopem-ousooc.exe udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\thivom.dll udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\rmass.exe udloavak-acur.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe udloavak-acur.exe -
resource yara_rule behavioral1/memory/616-9-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/files/0x000e00000001434d-8.dat upx behavioral1/memory/616-43-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral1/memory/2440-55-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\ntdbg.exe udloavak-acur.exe File opened for modification C:\Program Files (x86)\Common Files\System\RECOVER32.DLL udloavak-acur.exe File opened for modification C:\Program Files (x86)\Common Files\System\gymspzd.dll udloavak-acur.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe udloavak-acur.exe File opened for modification C:\Program Files (x86)\Common Files\System\rmass.exe udloavak-acur.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe udloavak-acur.exe File opened for modification C:\Program Files (x86)\Common Files\System\ahuy.exe udloavak-acur.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe udloavak-acur.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language udloavak-acur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 2440 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe 616 udloavak-acur.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 616 udloavak-acur.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1980 wrote to memory of 616 1980 f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe 31 PID 1980 wrote to memory of 616 1980 f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe 31 PID 1980 wrote to memory of 616 1980 f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe 31 PID 1980 wrote to memory of 616 1980 f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe 31 PID 616 wrote to memory of 428 616 udloavak-acur.exe 5 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 2440 616 udloavak-acur.exe 32 PID 616 wrote to memory of 2440 616 udloavak-acur.exe 32 PID 616 wrote to memory of 2440 616 udloavak-acur.exe 32 PID 616 wrote to memory of 2440 616 udloavak-acur.exe 32 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21 PID 616 wrote to memory of 1168 616 udloavak-acur.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe"C:\Users\Admin\AppData\Local\Temp\f5c09930dd903d6134a3d896827c7605689972468042dd429c6f1ea6172361ab.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\udloavak-acur.exe"C:\Windows\SysWOW64\udloavak-acur.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\udloavak-acur.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2440
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5ffe4d598b1c14f4ffff7c21b881a35e9
SHA1c81af6005c0a4ae0cd2f028e8ed9ac73a04606ab
SHA256974d4edcdbeea965c681385f5b125454041f40f7383249fc95843fa631fccf0c
SHA512c20379b56e449d792691bcbe93698b36352b30d2d854f021ff8e09eca6290a12dab27bcaf526635399e749dd759b0103c3de9dfcb0176f0cb2445c8b4edb39ea
-
Filesize
5KB
MD5c8521a5fdd1c9387d536f599d850b195
SHA1a543080665107b7e32bcc1ed19dbfbc1d2931356
SHA256fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5
SHA512541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd
-
Filesize
34KB
MD513cb46ed7728ac50c3056afdbd7b877a
SHA110a19a2279c7d2895053f0e013795b011408db28
SHA256a4df6235e2dc4ae21a6c8321d5c263e088703981715f14a2ef801039053eb07e
SHA512b2393b77f020285aecbd16ad640cb8394934ac46994cb13649c33a0ec643dd6c7b934a365d5e32362d3344cc178dd845afd3c0dc42ce291336362081e6fe6f6d
-
Filesize
36KB
MD57852cb9126d90595f66f65e640763d42
SHA182e03a2fab33fb085610262a94931c1bf6740e3d
SHA25605c287a41e50dff94f48df198562992f1ad8020b36d0af4ad1bb68500f23d337
SHA512048332e4408251d8f7d8a9cfda0221b9359fb5009f79526fbd8ff2c4648180deebb545ece46afaeac1d5846b395cbdb7b21c000c40ea2067ee6ab6884324689d