Analysis
-
max time kernel
136s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-01-2021 17:52
General
-
Target
ig.bin.exe
-
Size
21KB
-
MD5
d10baf3651281f8d8ba87c5e824c31af
-
SHA1
2674f1891609f04d576cf295a6c4bc004488357a
-
SHA256
4940614325f6ba206d9eab2b1b82af37e9f662a3b9c97eff00a7a398169e22fa
-
SHA512
1c0d6f387d44c4c4097ebc65f477d9b1728e76a9aac7e6d7c3768e7c3ebddfe6e65611693e2c93a873ca198b2fe31cc13a01b43cbff3a01ca9200f8d7e8757a8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 341 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ig.bin.exe"C:\Users\Admin\AppData\Local\Temp\ig.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\rrqjwrx5.inf2⤵
-
C:\Windows\system32\cmd.execmd /c start C:\Windows\temp\k0hsi4cj.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\k0hsi4cj.exeC:\Windows\temp\k0hsi4cj.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ig.bin.exe.logMD5
d63ff49d7c92016feb39812e4db10419
SHA12307d5e35ca9864ffefc93acf8573ea995ba189b
SHA256375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
SHA51200f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
-
C:\Windows\Temp\k0hsi4cj.exeMD5
d166f7842ec4262f5449b71e7204adf9
SHA113e771dca99f3fd2350fa4342f4b04dccb5f04a0
SHA25618e8c2a8bc25746a1ed208445ae68144e95227a25774e5802e560c09874a3e82
SHA51298a5e7b2920031c5423603dbb2be36f69c2ee590ec6926f7487b88c041925035f89442a98a1b77670ecd8d10f6b2d76c05db1411348ce2c2594d4c32cdd44c4f
-
C:\Windows\temp\k0hsi4cj.exeMD5
d166f7842ec4262f5449b71e7204adf9
SHA113e771dca99f3fd2350fa4342f4b04dccb5f04a0
SHA25618e8c2a8bc25746a1ed208445ae68144e95227a25774e5802e560c09874a3e82
SHA51298a5e7b2920031c5423603dbb2be36f69c2ee590ec6926f7487b88c041925035f89442a98a1b77670ecd8d10f6b2d76c05db1411348ce2c2594d4c32cdd44c4f
-
C:\Windows\temp\rrqjwrx5.infMD5
8c73f25a87e99a656aceaa4a1bd01bce
SHA16097429bbdf64edd52a6e51a99c83e0efadba6e2
SHA2569571554d2ca05dd1aefa5c29793af8f5e7b09f608ac6fe4d976a3c431173f133
SHA512e86288eb0f267591279329afb80049f5c3940c464243d0bac4216177d67ae136d9f402d3fe7a4c5bc3bbc7a56494e32abc89ee2aa4465c11d271b603299c0bf7
-
memory/644-3-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/644-2-0x00007FFC34C00000-0x00007FFC355EC000-memory.dmpFilesize
9.9MB
-
memory/2836-20-0x0000000005E40000-0x0000000005E41000-memory.dmpFilesize
4KB
-
memory/2836-13-0x0000000000000000-mapping.dmp
-
memory/2836-14-0x0000000000000000-mapping.dmp
-
memory/2836-17-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/2836-18-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/2836-21-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/2836-22-0x0000000005A20000-0x0000000005A21000-memory.dmpFilesize
4KB
-
memory/3768-11-0x000002226D360000-0x000002226D361000-memory.dmpFilesize
4KB
-
memory/3768-7-0x000002226D330000-0x000002226D331000-memory.dmpFilesize
4KB
-
memory/3768-5-0x0000000000000000-mapping.dmp