Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/03/2025, 17:44
General
-
Target
3a544fd2cae90783ee27c8440c82bd5053d08275bb860dfb4b5d7211d035ca8b.exe
-
Size
96KB
-
MD5
15db2155b7c1bb345369e3fea1748f76
-
SHA1
d2479b4e60403a211bb7c4ad72f5811d72b967f2
-
SHA256
3a544fd2cae90783ee27c8440c82bd5053d08275bb860dfb4b5d7211d035ca8b
-
SHA512
6cf6aa1c0b6bf6ed6a676b768dda04fabfc9096aed1d6502bfb1fa9e66ffbc37cf41943b15213b4e613716b9649d6b13b5ed1044f2f180b6d769c8bc6c1a1862
-
SSDEEP
1536:6LxJJlguY/NbvWU2VkWlVvtlqDyKJR40AEEoU:cc/R+U23vtlPR0p
Malware Config
Signatures
-
Blocklisted process makes network request 10 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 24 IoCs
-
Suspicious use of SendNotifyMessage 20 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a544fd2cae90783ee27c8440c82bd5053d08275bb860dfb4b5d7211d035ca8b.exe"C:\Users\Admin\AppData\Local\Temp\3a544fd2cae90783ee27c8440c82bd5053d08275bb860dfb4b5d7211d035ca8b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&c:\vahgr.exe "C:\Users\Admin\AppData\Local\Temp\3a544fd2cae90783ee27c8440c82bd5053d08275bb860dfb4b5d7211d035ca8b.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
\??\c:\vahgr.exec:\vahgr.exe "C:\Users\Admin\AppData\Local\Temp\3a544fd2cae90783ee27c8440c82bd5053d08275bb860dfb4b5d7211d035ca8b.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\iodqb\wbpdeyo.dll",init c:\vahgr.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD542fe886bcb6460f7c2a46e21ecac5da6
SHA17d9a1c9fe17121cf61444da965f29e974a95ede2
SHA256b6bc7902da0250f6ca920b35b222f6a0fe62102caf05d2a1722c4d3b225a0a9e
SHA5123d1a7dc1d9ca8a4376302ba20df584ad59b98e0d3b18b06b22d7f5a455833ce124e412fc1922a3b704dcbafa31987cda3115c9a71dd6299683502cebae33567c
-
Filesize
96KB
MD579779acd7c1fed373c5301805004c777
SHA1bb2e51df3592aa9d0bb4f60d40c5391a1b86c185
SHA256e94b29ee158d3d64f89585f3de729d3ef013b58ad1da8d4873cb7352928bee35
SHA5129a1438706d2d393b67ba7a5de2ad639394e10255e96657918f0663a98bd29a568e41023d1db98b70b5546bbb643f6c9ae4bb434384138cd04f6c9c3bbd278b32
-
Filesize
8KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
8KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB