Overview
overview
10Static
static
8ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
8ฺฺฺ�...ฺฺ
windows10_x64
3ฺฺฺ�...ฺฺ
windows10_x64
4ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
9ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
8ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
3ฺฺฺ�...ฺฺ
windows10_x64
1ฺฺฺ�...ฺฺ
windows10_x64
3ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
8ฺฺฺ�...ฺฺ
windows10_x64
10ฺฺฺ�...ฺฺ
windows10_x64
1ฺฺฺ�...ฺฺ
windows10_x64
1Analysis
-
max time kernel
266s -
max time network
279s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 15:58
Static task
static1
Behavioral task
behavioral1
Sample
1.bin/1.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral2
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
31.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral4
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral6
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral8
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral10
Sample
HYDRA.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
Keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral12
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral14
Sample
OnlineInstaller.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral16
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral18
Sample
WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
api.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral20
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
good.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral22
Sample
infected dot net installer.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
update.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral24
Sample
vir1.xls
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
xNet.dll
Resource
win10v20201028
windows10_x64
General
Malware Config
Signatures
-
Nirsoft 2 IoCs
resource yara_rule behavioral12/files/0x0004000000000693-59.dat Nirsoft behavioral12/files/0x0004000000000693-60.dat Nirsoft -
Executes dropped EXE 13 IoCs
pid Process 3616 keygen-pr.exe 2144 keygen-step-3.exe 2692 keygen-step-4.exe 2672 key.exe 3400 whhw.exe 3024 setup.upx.exe 2124 id6.exe 3176 Setup.exe 3820 Setup.tmp 2200 searzar.exe 2308 hjjgaa.exe 2800 jfiag_gg.exe 3680 jfiag_gg.exe -
resource yara_rule behavioral12/files/0x000200000001ab71-27.dat upx behavioral12/files/0x000200000001ab71-26.dat upx behavioral12/files/0x000100000001ab7d-49.dat upx behavioral12/files/0x000100000001ab7d-50.dat upx behavioral12/files/0x0004000000000693-55.dat upx behavioral12/files/0x0004000000000693-56.dat upx -
resource yara_rule behavioral12/files/0x000100000001ab6b-52.dat vmprotect behavioral12/files/0x000100000001ab6b-53.dat vmprotect -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kissq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kissq.exe" hjjgaa.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 2 IoCs
pid Process 1272 PING.EXE 3708 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3820 Setup.tmp 3820 Setup.tmp 3680 jfiag_gg.exe 3680 jfiag_gg.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3820 Setup.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2124 id6.exe 2124 id6.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 3192 wrote to memory of 4056 3192 Lonelyscreen.1.2.9.keygen.by.Paradox.exe 79 PID 3192 wrote to memory of 4056 3192 Lonelyscreen.1.2.9.keygen.by.Paradox.exe 79 PID 3192 wrote to memory of 4056 3192 Lonelyscreen.1.2.9.keygen.by.Paradox.exe 79 PID 4056 wrote to memory of 3616 4056 cmd.exe 82 PID 4056 wrote to memory of 3616 4056 cmd.exe 82 PID 4056 wrote to memory of 3616 4056 cmd.exe 82 PID 4056 wrote to memory of 2144 4056 cmd.exe 83 PID 4056 wrote to memory of 2144 4056 cmd.exe 83 PID 4056 wrote to memory of 2144 4056 cmd.exe 83 PID 4056 wrote to memory of 2692 4056 cmd.exe 84 PID 4056 wrote to memory of 2692 4056 cmd.exe 84 PID 4056 wrote to memory of 2692 4056 cmd.exe 84 PID 2144 wrote to memory of 2356 2144 keygen-step-3.exe 85 PID 2144 wrote to memory of 2356 2144 keygen-step-3.exe 85 PID 2144 wrote to memory of 2356 2144 keygen-step-3.exe 85 PID 2356 wrote to memory of 1272 2356 cmd.exe 87 PID 2356 wrote to memory of 1272 2356 cmd.exe 87 PID 2356 wrote to memory of 1272 2356 cmd.exe 87 PID 3616 wrote to memory of 2672 3616 keygen-pr.exe 88 PID 3616 wrote to memory of 2672 3616 keygen-pr.exe 88 PID 3616 wrote to memory of 2672 3616 keygen-pr.exe 88 PID 2692 wrote to memory of 3400 2692 keygen-step-4.exe 89 PID 2692 wrote to memory of 3400 2692 keygen-step-4.exe 89 PID 2692 wrote to memory of 3400 2692 keygen-step-4.exe 89 PID 3400 wrote to memory of 3024 3400 whhw.exe 90 PID 3400 wrote to memory of 3024 3400 whhw.exe 90 PID 3400 wrote to memory of 3024 3400 whhw.exe 90 PID 2672 wrote to memory of 1432 2672 key.exe 91 PID 2672 wrote to memory of 1432 2672 key.exe 91 PID 2672 wrote to memory of 1432 2672 key.exe 91 PID 3024 wrote to memory of 1200 3024 setup.upx.exe 92 PID 3024 wrote to memory of 1200 3024 setup.upx.exe 92 PID 3024 wrote to memory of 1200 3024 setup.upx.exe 92 PID 1200 wrote to memory of 3708 1200 cmd.exe 94 PID 1200 wrote to memory of 3708 1200 cmd.exe 94 PID 1200 wrote to memory of 3708 1200 cmd.exe 94 PID 2692 wrote to memory of 2124 2692 keygen-step-4.exe 95 PID 2692 wrote to memory of 2124 2692 keygen-step-4.exe 95 PID 2692 wrote to memory of 2124 2692 keygen-step-4.exe 95 PID 2692 wrote to memory of 3176 2692 keygen-step-4.exe 96 PID 2692 wrote to memory of 3176 2692 keygen-step-4.exe 96 PID 2692 wrote to memory of 3176 2692 keygen-step-4.exe 96 PID 3176 wrote to memory of 3820 3176 Setup.exe 97 PID 3176 wrote to memory of 3820 3176 Setup.exe 97 PID 3176 wrote to memory of 3820 3176 Setup.exe 97 PID 3820 wrote to memory of 2200 3820 Setup.tmp 98 PID 3820 wrote to memory of 2200 3820 Setup.tmp 98 PID 3820 wrote to memory of 2200 3820 Setup.tmp 98 PID 2692 wrote to memory of 2308 2692 keygen-step-4.exe 99 PID 2692 wrote to memory of 2308 2692 keygen-step-4.exe 99 PID 2692 wrote to memory of 2308 2692 keygen-step-4.exe 99 PID 2308 wrote to memory of 2800 2308 hjjgaa.exe 100 PID 2308 wrote to memory of 2800 2308 hjjgaa.exe 100 PID 2308 wrote to memory of 2800 2308 hjjgaa.exe 100 PID 2308 wrote to memory of 3680 2308 hjjgaa.exe 101 PID 2308 wrote to memory of 3680 2308 hjjgaa.exe 101 PID 2308 wrote to memory of 3680 2308 hjjgaa.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lonelyscreen.1.2.9.keygen.by.Paradox\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"C:\Users\Admin\AppData\Local\Temp\Lonelyscreen.1.2.9.keygen.by.Paradox\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵PID:1432
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:1272
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30007⤵
- Runs ping.exe
PID:3708
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\is-V2NMG.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-V2NMG.tmp\Setup.tmp" /SL5="$30232,1223153,733696,C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe"6⤵
- Executes dropped EXE
PID:2200
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3680
-
-
-
-