Overview
overview
10Static
static
10Enigma32g.exe
windows7-x64
3Enigma32g.exe
windows10-2004-x64
3daytjhasdawd.exe
windows7-x64
10daytjhasdawd.exe
windows10-2004-x64
10ghdtawedtrgh.exe
windows7-x64
10ghdtawedtrgh.exe
windows10-2004-x64
10hsefawdrthg.exe
windows7-x64
10hsefawdrthg.exe
windows10-2004-x64
10hyfdaethfhfaed.exe
windows7-x64
3hyfdaethfhfaed.exe
windows10-2004-x64
5jdrgsotrti.exe
windows7-x64
10jdrgsotrti.exe
windows10-2004-x64
10jgurtgjasdth.exe
windows7-x64
10jgurtgjasdth.exe
windows10-2004-x64
10mfcthased.exe
windows7-x64
10mfcthased.exe
windows10-2004-x64
10mnftyjkrgjsae.exe
windows7-x64
10mnftyjkrgjsae.exe
windows10-2004-x64
10mtbkkesfthae.exe
windows7-x64
7mtbkkesfthae.exe
windows10-2004-x64
7tyhkamwdmrg.exe
windows7-x64
10tyhkamwdmrg.exe
windows10-2004-x64
10vovdawdrg.exe
windows7-x64
10vovdawdrg.exe
windows10-2004-x64
10Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-12-2024 12:30
Behavioral task
behavioral1
Sample
Enigma32g.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Enigma32g.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
daytjhasdawd.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
daytjhasdawd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
ghdtawedtrgh.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
ghdtawedtrgh.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
hsefawdrthg.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
hsefawdrthg.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
hyfdaethfhfaed.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
hyfdaethfhfaed.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
jdrgsotrti.exe
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
jdrgsotrti.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
jgurtgjasdth.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
jgurtgjasdth.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
mfcthased.exe
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
mfcthased.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
mnftyjkrgjsae.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
mnftyjkrgjsae.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
mtbkkesfthae.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
mtbkkesfthae.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
tyhkamwdmrg.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
tyhkamwdmrg.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
vovdawdrg.exe
Resource
win7-20240903-en
General
-
Target
mtbkkesfthae.exe
-
Size
409KB
-
MD5
774a8755eccb3ebd8463204e8cd60941
-
SHA1
d8ecf01619f49c805ce41a2317c1a4ca99cfb270
-
SHA256
88200c0685cdb81d2aa94923ffcca110416d4dd9599e00c44635f13c630aa254
-
SHA512
d7a6f5e8259a48e7ca331233289c37f8d9769f31b6e6878f52c1b18d0eceaa4c5dd899562a0abeda29640fa88b76bc7b70a57d3d1752d80b979f617e600f1b0e
-
SSDEEP
6144:zhk7s+AfJjoF3U5w81tLffIru6t1tztD675DoRK3L9YhZmdC/0fNFZH97ndaW9:P+UJjoF3U5w8rk8LeYPR97nQW
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2068 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mtbkkesfthae.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mtbkkesfthae.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mtbkkesfthae.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 988 timeout.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a mtbkkesfthae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 mtbkkesfthae.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a mtbkkesfthae.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2756 mtbkkesfthae.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2068 2756 mtbkkesfthae.exe 32 PID 2756 wrote to memory of 2068 2756 mtbkkesfthae.exe 32 PID 2756 wrote to memory of 2068 2756 mtbkkesfthae.exe 32 PID 2756 wrote to memory of 2068 2756 mtbkkesfthae.exe 32 PID 2068 wrote to memory of 988 2068 cmd.exe 34 PID 2068 wrote to memory of 988 2068 cmd.exe 34 PID 2068 wrote to memory of 988 2068 cmd.exe 34 PID 2068 wrote to memory of 988 2068 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\mtbkkesfthae.exe"C:\Users\Admin\AppData\Local\Temp\mtbkkesfthae.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\mtbkkesfthae.exe" & rd /s /q "C:\ProgramData\GCGCFCBAKKFB" & exit2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\timeout.exetimeout /t 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:988
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b