Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/04/2026, 23:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DoonTheLustsofMahdIb.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
DoonTheLustsofMahdIb.msi
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target DoonTheLustsofMahdIb.msi
- Size 27.4MB
- Sample260427-3b3mfaev3k
- SHA256 8e7fbd93d615e5143e9b2abf38eb1cc670c8bf59b7adc31c2d0bf5334d027a22
- MD5 76c83289f6ac6e15b47bc153693edaf3
- SHA1 d2718d657d24661df97cfaf894049fbcf9b6b8e9
- SHA512 0d98715427f4053818252b0719befbceaec1311df5a0fd7d30a1b67eccbfc4be487f63a4d4d55a9aad0d945ac1fb3c041799007f5095663d83a086e0dd2834ec
- SSDEEP 786432:hawzXsrEkqe3N/Qz4BRaRgEjyTeAu8EnF:haxrEk13FQz4XEjyqAO
- TLSH T14C5733D3D0B1068BDC3B88368678FA9901A9BD45DD42482EB65CF36984FB7D2B1FE015
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2260 LxiUdiWIvh.exe 5376 LxiUdiWIvh.exe - Loads dropped DLL 1 IoCs
pid Process 5376 LxiUdiWIvh.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Installer\e583611.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF4D1D9EE98787F33D.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF6D1FFC89F9FA984A.TMP msiexec.exe File created C:\Windows\Installer\e58360f.msi msiexec.exe File opened for modification C:\Windows\Installer\e58360f.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFC67DD2437D052C2A.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{4775B19F-9A14-47CD-BA2A-10264B111D13} msiexec.exe File created C:\Windows\SystemTemp\~DF9A5871417CDB1715.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI3738.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1792 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611ecaf51c3c1a840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000611ecaf50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900611ecaf5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a611ecaf5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d611ecaf5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3728 msiexec.exe 3728 msiexec.exe 5376 LxiUdiWIvh.exe 5376 LxiUdiWIvh.exe 5376 LxiUdiWIvh.exe 5376 LxiUdiWIvh.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1792 msiexec.exe Token: SeIncreaseQuotaPrivilege 1792 msiexec.exe Token: SeSecurityPrivilege 3728 msiexec.exe Token: SeCreateTokenPrivilege 1792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1792 msiexec.exe Token: SeLockMemoryPrivilege 1792 msiexec.exe Token: SeIncreaseQuotaPrivilege 1792 msiexec.exe Token: SeMachineAccountPrivilege 1792 msiexec.exe Token: SeTcbPrivilege 1792 msiexec.exe Token: SeSecurityPrivilege 1792 msiexec.exe Token: SeTakeOwnershipPrivilege 1792 msiexec.exe Token: SeLoadDriverPrivilege 1792 msiexec.exe Token: SeSystemProfilePrivilege 1792 msiexec.exe Token: SeSystemtimePrivilege 1792 msiexec.exe Token: SeProfSingleProcessPrivilege 1792 msiexec.exe Token: SeIncBasePriorityPrivilege 1792 msiexec.exe Token: SeCreatePagefilePrivilege 1792 msiexec.exe Token: SeCreatePermanentPrivilege 1792 msiexec.exe Token: SeBackupPrivilege 1792 msiexec.exe Token: SeRestorePrivilege 1792 msiexec.exe Token: SeShutdownPrivilege 1792 msiexec.exe Token: SeDebugPrivilege 1792 msiexec.exe Token: SeAuditPrivilege 1792 msiexec.exe Token: SeSystemEnvironmentPrivilege 1792 msiexec.exe Token: SeChangeNotifyPrivilege 1792 msiexec.exe Token: SeRemoteShutdownPrivilege 1792 msiexec.exe Token: SeUndockPrivilege 1792 msiexec.exe Token: SeSyncAgentPrivilege 1792 msiexec.exe Token: SeEnableDelegationPrivilege 1792 msiexec.exe Token: SeManageVolumePrivilege 1792 msiexec.exe Token: SeImpersonatePrivilege 1792 msiexec.exe Token: SeCreateGlobalPrivilege 1792 msiexec.exe Token: SeBackupPrivilege 1824 vssvc.exe Token: SeRestorePrivilege 1824 vssvc.exe Token: SeAuditPrivilege 1824 vssvc.exe Token: SeBackupPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe Token: SeTakeOwnershipPrivilege 3728 msiexec.exe Token: SeRestorePrivilege 3728 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1792 msiexec.exe 1792 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3728 wrote to memory of 5164 3728 msiexec.exe 83 PID 3728 wrote to memory of 5924 3728 msiexec.exe 85 PID 5924 wrote to memory of 2260 5924 cmd.exe 87 PID 2260 wrote to memory of 5376 2260 LxiUdiWIvh.exe 89 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DoonTheLustsofMahdIb.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1792
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5164
-
-
C:\Windows\system32\cmd.execmd.exe /c "RUeExvQxSsQlExywkfGm.cmd"2⤵
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\aSatEOp\LxiUdiWIvh.exe"LxiUdiWIvh.exe" "tIFvDgrpVSPx.js"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\aSatEOp\LxiUdiWIvh.exeC:\Users\Admin\AppData\Local\aSatEOp\LxiUdiWIvh.exe C:\Users\Admin\AppData\Local\aSatEOp\fjofaGqQpfxsUtpo.dat4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5376
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e583610.rbs
- Size 9KB
- SHA256 f1a5f97c7447d2fd07c8a17bff443d20fdb846284fb0301e41bfeaee081a22cb
- MD5 8a3f48480c4db4621721825e05f28f8b
- SHA1 61296565c99dc185d6967b7e19c59017c93da31d
- SHA512 93619541b5bda8018f03e79279e045bcbe8441bd6bf959c70c425461c02ee771970271d2553fee3b0fe9f32efcf8b8016fc8160d31175204e6069ae5a2fcaa8f
- SSDEEP 96:CgoyRXRS2PCIuPVbzg0xEoqHMf+7p5ChCFCmMUdr5UjcCsThqmAUdr5UjcC6jWCs:CsaN3QC0rM/IXM/mgOlkpV
- TLSH T1B5126341B394C9B1DEAC1739C7670B443777E2D4AB42639B088D91249F2379E8F4D48A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0km45qur9yrmis3c.node
- Size 356KB
- SHA256 8b477dab403114209ec1258f6129f4634a61fa36421873dc3fcd8ab7ba0542aa
- MD5 fd9059a0fdb58255def1175ffa24f605
- SHA1 baccb39eb1dc65bec18719272c79d61524b5b371
- SHA512 ed264ec8e82340fa6af4a20cde42dc2e98c8e0334f157932a91a7a66abf7b63dc5e515802f8a568a9547970f4bf9afadb3afbba76fdbffa45e0a7b615ff869fa
- SSDEEP 6144:FVX6t4JL4+kQhPe71JaYG5VwYNc/fCfpH+iL+XYsnbyImnZp5:FVXDc+ksPe7rQ3wYXlYYsnby/nZj
- TLSH T19674AE5A72E40CB4E9A7917D89934A0AE7F3BC024B60D7CF03A056AB9F273D0953E751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\aSatEOp\RUeExvQxSsQlExywkfGm.cmd
- Size 69B
- SHA256 3935e4899dc641e3d8575ea0e3b137539f1a941dcf2ac43fe030e73156fa4b4a
- MD5 bee43d8d4df7f88ad9c776a507e249b5
- SHA1 f29888c5108408903a94c84e81bf8c0741917d77
- SHA512 d99ff9d1e651a5d8a8e2702c68e08f18fb571dad894278e8a0e27946428614b38b5bdd662013071af6d8b12285a8ed94846b2ed182cd81932a6f6dda734ab6d0
- TLSH T118A022002A200C0B08800C0020FF3008FCAFB0CAE0002C02000BCC3C2E0FC88A0CB0CB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\aSatEOp\fjofaGqQpfxsUtpo.dat
- Size 1.7MB
- SHA256 a143d9df934881da7a815978276e2ab777af61180598eba4e5bae4ec77cce306
- MD5 6dc173ea3248c0bea5fd1c0e34e93b74
- SHA1 7898af4cf5e13993933a0ca36ceb13229552bc94
- SHA512 2603d05ceaf83c92aa28aa0af8f0250b384ec639b6bdc285a0ca2af5e8cb27dfb0c4cc6a4c328da37746d04afb0c40b3a0a051deb26a9794852e5facd7ed782f
- SSDEEP 49152:2CAEdlS1DFwtNwoaxIcFfPAjpxpIVACHPstc18DWzrSOM:F
- TLSH T18A859ECEB48F64D4B9F587F06FDA7F6AC5AB50D32C81F90E702092744E1057A9B9E818
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\aSatEOp\tIFvDgrpVSPx.js
- Size 2KB
- SHA256 84fd4a031f420fcbb69ad3925fc5c8ffe9a542dc845f1a2495b9e5fc9e542200
- MD5 1002821359ae052a16cfba830478e205
- SHA1 7f170b9e53ef7656294789caee19d4b1c876a8d0
- SHA512 35f2fe1b0fa314024101f1f8dad30b8224b2acced3bd2361bdb1e1f1df937a2ed2b6c3d97c54c03e03393dad293743829974af5c8bd24866ddecc3fee502056a
- TLSH T17151DD8C65C331A827CAB5E77627D8F0E45FCEBD342814BFC2886CD4290C525D6A62F6
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e58360f.msi
- Size 27.4MB
- SHA256 8e7fbd93d615e5143e9b2abf38eb1cc670c8bf59b7adc31c2d0bf5334d027a22
- MD5 76c83289f6ac6e15b47bc153693edaf3
- SHA1 d2718d657d24661df97cfaf894049fbcf9b6b8e9
- SHA512 0d98715427f4053818252b0719befbceaec1311df5a0fd7d30a1b67eccbfc4be487f63a4d4d55a9aad0d945ac1fb3c041799007f5095663d83a086e0dd2834ec
- SSDEEP 786432:hawzXsrEkqe3N/Qz4BRaRgEjyTeAu8EnF:haxrEk13FQz4XEjyqAO
- TLSH T14C5733D3D0B1068BDC3B88368678FA9901A9BD45DD42482EB65CF36984FB7D2B1FE015
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.6MB
- SHA256 b02c1ddb7e5fa3426128f3e8a738caf30058a239aaf5d7079bbe5905efa72462
- MD5 cf5aa22da1e9d707a125a6aa34b55550
- SHA1 cefc8b058d9bb0e77f81e27356dd74d56b0abf52
- SHA512 4f149ec6191c81554bc072ef6e06e9ba5e52768f1546ef8d21269ea7337525c7bc4af9475e65f926522ae9c4ed3abf189c1ab1a7ac1781a98f820a7d2cb297a0
- SSDEEP 24576:42gmSp1idoO/vvTLvmEuB0Hq/6pPwYgOWWXd3JEUN/6IkIQRoPFjr5eDB:/
- TLSH T1F447D12436F92210E7B39E3C6CF06A234D3A7D5B9C15DE8D05461B8E0961FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{f5ca1e61-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9143d3c3-fb2f-489c-8de5-1f9f199ffbc8}_OnDiskSnapshotProp
- Size 6KB
- SHA256 ac36535fa1f76c32f75b2f1ce5c23780dbaa9e8a57ea97fc0c464980c2bf8855
- MD5 f37d857348e51ff03f3c6e6501f8d4da
- SHA1 6c1cc8564049d04aecb76bdcb098d20b3857736e
- SHA512 483ed69100ca528a03f8aaf5856ef03a60d3920d449eab66b3db84445f9abb2ff473a1b3f5ed1c5fc1806a9920bf51797b872724a7ec877b1eeafad46306abe7
- SSDEEP 96:FJOjavc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Xxb++ZVmN
- TLSH T16ED187085AE54311E2B3AB7129F14557A877B911EF33CB8E0198638E6670A10F876F6F
- MD5 SHA1 SHA512 SSDEEP TLSH