Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 15:10
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20241007-en
General
-
Target
LB3.exe
-
Size
147KB
-
MD5
67008d6538e43ec4ef57359f7ca4f15f
-
SHA1
65078b6e640146bde300af0a6d70b91f45244343
-
SHA256
cb43fff6739186bdf2af5d4f34624c020196616cdae86fb755bf3d250bbe9b12
-
SHA512
9a9e281dcf6a783cb69f6ab9703af716dd304883ad1a92a17bf4498745b563b2560e4624d839cc7577776d31e22f596d821a183c4c4ec350d7fa7a8f0e44db54
-
SSDEEP
3072:V6glyuxE4GsUPnliByocWepTN5GqoLVB5FHONF:V6gDBGpvEByocWeX/oZB7u/
Malware Config
Extracted
C:\IoBMyuygl.README.txt
https://tox.chat/download.html
Signatures
-
Renames multiple (358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1736 A1BB.tmp -
Executes dropped EXE 1 IoCs
pid Process 1736 A1BB.tmp -
Loads dropped DLL 1 IoCs
pid Process 1528 LB3.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini LB3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini LB3.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\IoBMyuygl.bmp" LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\IoBMyuygl.bmp" LB3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1736 A1BB.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LB3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1BB.tmp -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop LB3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\WallpaperStyle = "10" LB3.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.IoBMyuygl LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.IoBMyuygl\ = "IoBMyuygl" LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IoBMyuygl\DefaultIcon LB3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IoBMyuygl LB3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IoBMyuygl\DefaultIcon\ = "C:\\ProgramData\\IoBMyuygl.ico" LB3.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe 1528 LB3.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp 1736 A1BB.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeDebugPrivilege 1528 LB3.exe Token: 36 1528 LB3.exe Token: SeImpersonatePrivilege 1528 LB3.exe Token: SeIncBasePriorityPrivilege 1528 LB3.exe Token: SeIncreaseQuotaPrivilege 1528 LB3.exe Token: 33 1528 LB3.exe Token: SeManageVolumePrivilege 1528 LB3.exe Token: SeProfSingleProcessPrivilege 1528 LB3.exe Token: SeRestorePrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSystemProfilePrivilege 1528 LB3.exe Token: SeTakeOwnershipPrivilege 1528 LB3.exe Token: SeShutdownPrivilege 1528 LB3.exe Token: SeDebugPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeBackupPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe Token: SeSecurityPrivilege 1528 LB3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1528 wrote to memory of 1736 1528 LB3.exe 32 PID 1528 wrote to memory of 1736 1528 LB3.exe 32 PID 1528 wrote to memory of 1736 1528 LB3.exe 32 PID 1528 wrote to memory of 1736 1528 LB3.exe 32 PID 1528 wrote to memory of 1736 1528 LB3.exe 32 PID 1736 wrote to memory of 1704 1736 A1BB.tmp 33 PID 1736 wrote to memory of 1704 1736 A1BB.tmp 33 PID 1736 wrote to memory of 1704 1736 A1BB.tmp 33 PID 1736 wrote to memory of 1704 1736 A1BB.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\ProgramData\A1BB.tmp"C:\ProgramData\A1BB.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A1BB.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1704
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5ffda1e2e7f86c86ecc879151549e5f8e
SHA14d61e9b1c00ded29e2077a93cc377e2d059a0789
SHA25646b904d5dfb3405cf7fcff81b0dd6e7e419dfddee5d092b6977f5b4c4337c699
SHA512ddd9a95ed66028bf4821ef38d892f982148b11b151fc8c94b7f5b4433012f05634b9ca3d9190aef71963bafdec27ee91789f8e6c3356b2dd9ad50bcf6a2c4db1
-
Filesize
1KB
MD50fc102c3422c21c1aadfaa1a656dc970
SHA149cc540c7a5eaa4f12cacdb21e788335d535ccc0
SHA256fe49a063ebe0b4154321062c1110876bab03710ab367d8a5e3dee6e75fc79029
SHA5128cf822ec2d69b4f4bfdc3303b142ff21315d6e5483a98efa834d039f68a6f57e249d374d3c127a65f524123464532afa5700b4dd4808236b082f7a420a260ab0
-
Filesize
147KB
MD559a1e29135ca8d137712301647898366
SHA12aea1052a8db1524fd672cfae7eabd4e43e94043
SHA256ec2a38181e78e62180397531611d3e25bdee328023007330f09ef954af60b702
SHA512655097ab9cf684b5b13d123d43d7c5e5bf1f5794e5d1898b8103256d2fb28c58b05a2a00704dc67cc00c9dfecd001ec9ba919698045cbc97936291fbd3aa3a38
-
Filesize
129B
MD50db45533ec19622a742d02afbd0c4aa5
SHA19deb57b1ef3f261fda2149190282f2fe440b1ea8
SHA2566a6ba3a73f080e3d566470f32f64cc3ea9c8970acba14af42c832c3f49bdcdda
SHA512af93c4d177de0ccbfa78b3f63963eaee90b3e636de0e9676cc8b221fb98a0d0a8fde8b10665dfef6bd9ffcc1f573067e3d088d9d7db19036f69394f1c17ba3f5
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf