Overview
overview
10Static
static
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
4ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
4ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10Resubmissions
12-11-2021 18:04
211112-wnzb8aahhm 1019-11-2020 10:08
201119-rhwlt38jrx 1018-11-2020 17:26
201118-htd4fq29va 10Analysis
-
max time kernel
1686s -
max time network
1693s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 17:26
Static task
static1
Behavioral task
behavioral1
Sample
1.bin/1.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral2
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
31.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral4
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral6
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral8
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral10
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
HYDRA.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral12
Sample
Keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral14
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral16
Sample
OnlineInstaller.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral18
Sample
SecurityTaskManager_Setup.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral20
Sample
VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral22
Sample
___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
___ _ _____ __ ___/전산 및 비전산자료 보존 요청서/전산 및 비전산자료 보존 요.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral24
Sample
amtemu.v0.9.2.win-painter_edited.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
api.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral26
Sample
default.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral28
Sample
good.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
infected dot net installer.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral30
Sample
oof.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
ou55sg33s_1.exe
Resource
win10v20201028
windows10_x64
General
Malware Config
Signatures
-
Nirsoft 6 IoCs
resource yara_rule behavioral13/files/0x000300000001abd3-55.dat Nirsoft behavioral13/files/0x000300000001abd3-56.dat Nirsoft behavioral13/files/0x000300000001abd3-59.dat Nirsoft behavioral13/files/0x000300000001abd3-60.dat Nirsoft behavioral13/files/0x000300000001abd3-63.dat Nirsoft behavioral13/files/0x000300000001abd3-64.dat Nirsoft -
Executes dropped EXE 16 IoCs
pid Process 4076 keygen-pr.exe 2100 keygen-step-3.exe 3276 keygen-step-4.exe 1004 key.exe 1828 whhw.exe 8 key.exe 1836 setup.upx.exe 2236 id6.exe 1028 Setup.exe 3768 Setup.tmp 2320 searzar.exe 1140 hjjgaa.exe 2156 jfiag_gg.exe 3956 jfiag_gg.exe 908 jfiag_gg.exe 3552 jfiag_gg.exe -
resource yara_rule behavioral13/files/0x000200000001abe0-27.dat upx behavioral13/files/0x000200000001abe0-28.dat upx behavioral13/files/0x000100000001abea-45.dat upx behavioral13/files/0x000100000001abea-46.dat upx behavioral13/files/0x000300000001abd3-51.dat upx behavioral13/files/0x000300000001abd3-52.dat upx -
resource yara_rule behavioral13/files/0x000100000001abda-48.dat vmprotect behavioral13/files/0x000100000001abda-49.dat vmprotect -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kissq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kissq.exe" hjjgaa.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 32 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1004 set thread context of 8 1004 key.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 2 IoCs
pid Process 3840 PING.EXE 3860 PING.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1004 key.exe 1004 key.exe 3768 Setup.tmp 3768 Setup.tmp 3956 jfiag_gg.exe 3956 jfiag_gg.exe 908 jfiag_gg.exe 908 jfiag_gg.exe 3552 jfiag_gg.exe 3552 jfiag_gg.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeImpersonatePrivilege 1004 key.exe Token: SeTcbPrivilege 1004 key.exe Token: SeChangeNotifyPrivilege 1004 key.exe Token: SeCreateTokenPrivilege 1004 key.exe Token: SeBackupPrivilege 1004 key.exe Token: SeRestorePrivilege 1004 key.exe Token: SeIncreaseQuotaPrivilege 1004 key.exe Token: SeAssignPrimaryTokenPrivilege 1004 key.exe Token: SeImpersonatePrivilege 1004 key.exe Token: SeTcbPrivilege 1004 key.exe Token: SeChangeNotifyPrivilege 1004 key.exe Token: SeCreateTokenPrivilege 1004 key.exe Token: SeBackupPrivilege 1004 key.exe Token: SeRestorePrivilege 1004 key.exe Token: SeIncreaseQuotaPrivilege 1004 key.exe Token: SeAssignPrimaryTokenPrivilege 1004 key.exe Token: SeImpersonatePrivilege 1004 key.exe Token: SeTcbPrivilege 1004 key.exe Token: SeChangeNotifyPrivilege 1004 key.exe Token: SeCreateTokenPrivilege 1004 key.exe Token: SeBackupPrivilege 1004 key.exe Token: SeRestorePrivilege 1004 key.exe Token: SeIncreaseQuotaPrivilege 1004 key.exe Token: SeAssignPrimaryTokenPrivilege 1004 key.exe Token: SeImpersonatePrivilege 1004 key.exe Token: SeTcbPrivilege 1004 key.exe Token: SeChangeNotifyPrivilege 1004 key.exe Token: SeCreateTokenPrivilege 1004 key.exe Token: SeBackupPrivilege 1004 key.exe Token: SeRestorePrivilege 1004 key.exe Token: SeIncreaseQuotaPrivilege 1004 key.exe Token: SeAssignPrimaryTokenPrivilege 1004 key.exe Token: SeImpersonatePrivilege 1004 key.exe Token: SeTcbPrivilege 1004 key.exe Token: SeChangeNotifyPrivilege 1004 key.exe Token: SeCreateTokenPrivilege 1004 key.exe Token: SeBackupPrivilege 1004 key.exe Token: SeRestorePrivilege 1004 key.exe Token: SeIncreaseQuotaPrivilege 1004 key.exe Token: SeAssignPrimaryTokenPrivilege 1004 key.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3768 Setup.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2236 id6.exe 2236 id6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 3584 644 Lonelyscreen.1.2.9.keygen.by.Paradox.exe 78 PID 644 wrote to memory of 3584 644 Lonelyscreen.1.2.9.keygen.by.Paradox.exe 78 PID 644 wrote to memory of 3584 644 Lonelyscreen.1.2.9.keygen.by.Paradox.exe 78 PID 3584 wrote to memory of 4076 3584 cmd.exe 81 PID 3584 wrote to memory of 4076 3584 cmd.exe 81 PID 3584 wrote to memory of 4076 3584 cmd.exe 81 PID 3584 wrote to memory of 2100 3584 cmd.exe 82 PID 3584 wrote to memory of 2100 3584 cmd.exe 82 PID 3584 wrote to memory of 2100 3584 cmd.exe 82 PID 2100 wrote to memory of 2148 2100 keygen-step-3.exe 83 PID 2100 wrote to memory of 2148 2100 keygen-step-3.exe 83 PID 2100 wrote to memory of 2148 2100 keygen-step-3.exe 83 PID 3584 wrote to memory of 3276 3584 cmd.exe 84 PID 3584 wrote to memory of 3276 3584 cmd.exe 84 PID 3584 wrote to memory of 3276 3584 cmd.exe 84 PID 2148 wrote to memory of 3840 2148 cmd.exe 86 PID 2148 wrote to memory of 3840 2148 cmd.exe 86 PID 2148 wrote to memory of 3840 2148 cmd.exe 86 PID 4076 wrote to memory of 1004 4076 keygen-pr.exe 87 PID 4076 wrote to memory of 1004 4076 keygen-pr.exe 87 PID 4076 wrote to memory of 1004 4076 keygen-pr.exe 87 PID 3276 wrote to memory of 1828 3276 keygen-step-4.exe 88 PID 3276 wrote to memory of 1828 3276 keygen-step-4.exe 88 PID 3276 wrote to memory of 1828 3276 keygen-step-4.exe 88 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1004 wrote to memory of 8 1004 key.exe 89 PID 1828 wrote to memory of 1836 1828 whhw.exe 91 PID 1828 wrote to memory of 1836 1828 whhw.exe 91 PID 1828 wrote to memory of 1836 1828 whhw.exe 91 PID 1836 wrote to memory of 912 1836 setup.upx.exe 92 PID 1836 wrote to memory of 912 1836 setup.upx.exe 92 PID 1836 wrote to memory of 912 1836 setup.upx.exe 92 PID 912 wrote to memory of 3860 912 cmd.exe 94 PID 912 wrote to memory of 3860 912 cmd.exe 94 PID 912 wrote to memory of 3860 912 cmd.exe 94 PID 3276 wrote to memory of 2236 3276 keygen-step-4.exe 96 PID 3276 wrote to memory of 2236 3276 keygen-step-4.exe 96 PID 3276 wrote to memory of 2236 3276 keygen-step-4.exe 96 PID 3276 wrote to memory of 1028 3276 keygen-step-4.exe 98 PID 3276 wrote to memory of 1028 3276 keygen-step-4.exe 98 PID 3276 wrote to memory of 1028 3276 keygen-step-4.exe 98 PID 1028 wrote to memory of 3768 1028 Setup.exe 99 PID 1028 wrote to memory of 3768 1028 Setup.exe 99 PID 1028 wrote to memory of 3768 1028 Setup.exe 99 PID 3768 wrote to memory of 2320 3768 Setup.tmp 100 PID 3768 wrote to memory of 2320 3768 Setup.tmp 100 PID 3768 wrote to memory of 2320 3768 Setup.tmp 100 PID 3276 wrote to memory of 1140 3276 keygen-step-4.exe 101 PID 3276 wrote to memory of 1140 3276 keygen-step-4.exe 101 PID 3276 wrote to memory of 1140 3276 keygen-step-4.exe 101 PID 1140 wrote to memory of 2156 1140 hjjgaa.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lonelyscreen.1.2.9.keygen.by.Paradox\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"C:\Users\Admin\AppData\Local\Temp\Lonelyscreen.1.2.9.keygen.by.Paradox\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:8
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:3840
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30007⤵
- Runs ping.exe
PID:3860
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2236
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\is-U3I3J.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-U3I3J.tmp\Setup.tmp" /SL5="$30242,1223153,733696,C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe"6⤵
- Executes dropped EXE
PID:2320
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
PID:2156
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3956
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
-
-