Analysis
-
max time kernel
142s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
light1.83/light_setup.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
light1.83/light_setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
light1.83/lpk.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
light1.83/lpk.dll
Resource
win10v2004-20241007-en
General
-
Target
light1.83/light_setup.exe
-
Size
204.5MB
-
MD5
8ca9c75dbe92b22456344462960b695d
-
SHA1
5d861549732193dcf8c6e4298c810f84f385c6a2
-
SHA256
59efb62de4784de77b8be1440bf51d7ac6a22570bfca0d5eee4ab2f48002951b
-
SHA512
293a2ac1bad7d2e06d9f663aaf1fec903b45216e9836b23510528d952540b2eab30d4dc3d5cf2d26d14641ee0879f279c76ea8e444823cbc975afcc1f43411e8
-
SSDEEP
98304:PXNHvURvNHU4+faCzkC2z5+IYA15ZRa+xdxB1xc:v9Ult+iCzkJzPtjJxc
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\BPFU\ImagePath = "C:\\Users\\Public\\Ypel\\Aimu.exe" light_setup.exe -
Executes dropped EXE 1 IoCs
pid Process 2808 light_setup.exe -
Loads dropped DLL 3 IoCs
pid Process 2260 light_setup.exe 2808 light_setup.exe 2808 light_setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language light_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language light_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main light_setup.exe -
Runs net.exe
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2808 light_setup.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2808 light_setup.exe 2808 light_setup.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2616 2260 light_setup.exe 30 PID 2260 wrote to memory of 2616 2260 light_setup.exe 30 PID 2260 wrote to memory of 2616 2260 light_setup.exe 30 PID 2260 wrote to memory of 2616 2260 light_setup.exe 30 PID 2260 wrote to memory of 2616 2260 light_setup.exe 30 PID 2260 wrote to memory of 2616 2260 light_setup.exe 30 PID 2260 wrote to memory of 2616 2260 light_setup.exe 30 PID 2616 wrote to memory of 2328 2616 Net.exe 32 PID 2616 wrote to memory of 2328 2616 Net.exe 32 PID 2616 wrote to memory of 2328 2616 Net.exe 32 PID 2616 wrote to memory of 2328 2616 Net.exe 32 PID 2616 wrote to memory of 2328 2616 Net.exe 32 PID 2616 wrote to memory of 2328 2616 Net.exe 32 PID 2616 wrote to memory of 2328 2616 Net.exe 32 PID 2260 wrote to memory of 2808 2260 light_setup.exe 33 PID 2260 wrote to memory of 2808 2260 light_setup.exe 33 PID 2260 wrote to memory of 2808 2260 light_setup.exe 33 PID 2260 wrote to memory of 2808 2260 light_setup.exe 33 PID 2260 wrote to memory of 2808 2260 light_setup.exe 33 PID 2260 wrote to memory of 2808 2260 light_setup.exe 33 PID 2260 wrote to memory of 2808 2260 light_setup.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\light1.83\light_setup.exe"C:\Users\Admin\AppData\Local\Temp\light1.83\light_setup.exe"1⤵
- Sets service image path in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\Net.exeNet Stop PcaSvc2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 Stop PcaSvc3⤵
- System Location Discovery: System Language Discovery
PID:2328
-
-
-
C:\Users\Admin\AppData\Local\Temp\g8BF49\light_setup.exeC:\Users\Admin\AppData\Local\Temp\g8BF49\light_setup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5be55a91a726e2ad26293dde6eb1970a2
SHA164696a3fa96dcb9bea3aacc533a4b5c7eb7627aa
SHA256191ffd48ea2a53472f662bff4d83e4b3a5bf544722de57c8e00b25b4225c32aa
SHA512cbc55c1bbc15f0ced2ab19445d89d7d7953132d50a290d35c4aca5df5aba2c4c2fe85b6cef00db5978970ca3a52f4e98851ae16b9cfd90becf4c40ec6167dd43
-
Filesize
364B
MD55e717774540f75a0b64e51f3746a1d76
SHA11c1255f0869892bb8837d7763b8eef24df593633
SHA2563207b9643a165b6268db6303186d152efa592677837797ea5fd1f71553dd5598
SHA5125bf4098275938796d11a7aff176103bff3448b0fd32a3b398b9f36f8c43aa94b15964b8496d7af795ea6fe23579eedfd0e23f67133a6409844beba113a72c7a0
-
Filesize
20.7MB
MD5027a6b8e19620e00ac4f3719e022b5ba
SHA18a7081fc6afa679a0237ad718fb763d685dbe327
SHA256ae6ee3a125289bb3562b89b7014166db8c69ba81da10b69da61bcf30e1086480
SHA512e9182116d8a9267c348ceae64a83f10724918e4657070c873a7d629a39f6f79bfca98fd676141071c9e4a24d627a80f83a46915dcbd4207791cd5c23c67487da
-
Filesize
20.9MB
MD55224be6315e1747700bcff2ec7191c1e
SHA1ee03a125c3f47948f2f2f3f13e51b50fb2870e01
SHA256db6e89720418d699853a004eca4ef643b80e8f3349e68add4a1edfd482a5c489
SHA5126c4445d885be8f425f074c41dacefe1abb79d75ca1e2d30970d7ba07680f5027d34e40a2d289164dbd83046961ddf87245c48427fd9383584a3c7ea6a5696424
-
Filesize
20.7MB
MD578d176cd101bec19c8e5a9ca23628509
SHA13cda6abc6d63062dade1162b1ddc72afdb107c79
SHA256d02ba7536a0496150b457212e568cd5ad59c5d3d8c938a93201d28852259c317
SHA512c58aa11951ddb8495092862c7d01beebd4337a47f2dccfcf8a81471983fd0b3c95c11cc1fde84056534ac92b11867f89a9267aeae7ca8feb883598cb6a47ef19