Resubmissions

22-11-2023 17:02

231122-vkac9adg64 10

19-01-2021 19:24

210119-s26yznnqsn 10

19-11-2020 13:14

201119-s41ec6lt86 10

Analysis

  • max time kernel
    1802s
  • max time network
    1694s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 13:14

General

  • Target

    2c01b007729230c415420ad641ad92eb.exe

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • NirSoft MailPassView 5 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 8 IoCs
  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe
    "C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Users\Admin\AppData\Roaming\wou\odm.exe
      "C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3548
      • C:\Users\Admin\AppData\Roaming\wou\odm.exe
        C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KGDSU
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1476
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
            5⤵
              PID:3140
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
              5⤵
                PID:3604
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
              C:\Users\Admin\AppData\Roaming\wou\KGDSU
              4⤵
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              PID:1976

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scripting

      1
      T1064

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Scripting

      1
      T1064

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\holderwb.txt
      • C:\Users\Admin\AppData\Roaming\wou\KGDSU
      • C:\Users\Admin\AppData\Roaming\wou\kja-pex
      • C:\Users\Admin\AppData\Roaming\wou\odm.exe
      • C:\Users\Admin\AppData\Roaming\wou\odm.exe
      • C:\Users\Admin\AppData\Roaming\wou\odm.exe
      • C:\Users\Admin\AppData\Roaming\wou\rid.ico
      • C:\Users\Admin\AppData\Roaming\wou\spd
      • memory/1476-13-0x0000000000400000-0x0000000000484000-memory.dmp
        Filesize

        528KB

      • memory/1476-14-0x000000000047EAEE-mapping.dmp
      • memory/1976-17-0x0000000000700000-0x00000000007CC000-memory.dmp
        Filesize

        816KB

      • memory/1976-16-0x00000000007164E1-mapping.dmp
      • memory/1976-15-0x0000000000700000-0x00000000007CC000-memory.dmp
        Filesize

        816KB

      • memory/3140-20-0x0000000000411654-mapping.dmp
      • memory/3140-19-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

      • memory/3140-21-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

      • memory/3548-2-0x0000000000000000-mapping.dmp
      • memory/3548-5-0x00000000738C0000-0x0000000073953000-memory.dmp
        Filesize

        588KB

      • memory/3568-9-0x0000000000000000-mapping.dmp
      • memory/3568-11-0x00000000738C0000-0x0000000073953000-memory.dmp
        Filesize

        588KB

      • memory/3604-23-0x0000000000442628-mapping.dmp
      • memory/3604-22-0x0000000000400000-0x0000000000458000-memory.dmp
        Filesize

        352KB

      • memory/3604-24-0x0000000000400000-0x0000000000458000-memory.dmp
        Filesize

        352KB