Analysis
-
max time kernel
113s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
27-02-2021 21:10
Static task
static1
Behavioral task
behavioral1
Sample
52025c.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
52025c.exe
-
Size
129KB
-
MD5
d138cbdc2ae133c81752e4c1e4e8561e
-
SHA1
e8afba3556dc948b960622ff1054d5a809d43baf
-
SHA256
52025c86ec0b35f42f22742b92c4bbca97bef3f3f7593b488af738e16673048d
-
SHA512
774dc7ebd5c6d5df4e90767ab038e5b1f4ebd2e66fe0a0718126f0ee8613b230fca44dcc946ebf8ac9bd57f95642fb725cbbef795837b9f38fe051e59adf0fb5
Malware Config
Signatures
-
Drops file in System32 directory 5 IoCs
Processes:
ContactDpi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat ContactDpi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ContactDpi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ContactDpi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ContactDpi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ContactDpi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
ContactDpi.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ContactDpi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ContactDpi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ContactDpi.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
Processes:
52025c.exeContactDpi.exepid process 4132 52025c.exe 4168 ContactDpi.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ContactDpi.exepid process 4168 ContactDpi.exe 4168 ContactDpi.exe 4168 ContactDpi.exe 4168 ContactDpi.exe 4168 ContactDpi.exe 4168 ContactDpi.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
52025c.exepid process 4132 52025c.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
52025c.exeContactDpi.exedescription pid process target process PID 4684 wrote to memory of 4132 4684 52025c.exe 52025c.exe PID 4684 wrote to memory of 4132 4684 52025c.exe 52025c.exe PID 4684 wrote to memory of 4132 4684 52025c.exe 52025c.exe PID 708 wrote to memory of 4168 708 ContactDpi.exe ContactDpi.exe PID 708 wrote to memory of 4168 708 ContactDpi.exe ContactDpi.exe PID 708 wrote to memory of 4168 708 ContactDpi.exe ContactDpi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52025c.exe"C:\Users\Admin\AppData\Local\Temp\52025c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\52025c.exe"C:\Users\Admin\AppData\Local\Temp\52025c.exe"2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\ContactDpi.exeC:\Windows\SysWOW64\ContactDpi.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ContactDpi.exe"C:\Windows\SysWOW64\ContactDpi.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/708-15-0x0000000003400000-0x0000000003410000-memory.dmpFilesize
64KB
-
memory/708-10-0x00000000033F0000-0x00000000033FE000-memory.dmpFilesize
56KB
-
memory/4132-9-0x0000000003260000-0x0000000003270000-memory.dmpFilesize
64KB
-
memory/4132-5-0x0000000000000000-mapping.dmp
-
memory/4132-6-0x0000000003250000-0x000000000325E000-memory.dmpFilesize
56KB
-
memory/4132-7-0x0000000000140000-0x0000000000166000-memory.dmpFilesize
152KB
-
memory/4168-12-0x00000000032F0000-0x00000000032FE000-memory.dmpFilesize
56KB
-
memory/4168-11-0x0000000000000000-mapping.dmp
-
memory/4168-13-0x0000000000140000-0x0000000000166000-memory.dmpFilesize
152KB
-
memory/4168-17-0x0000000003300000-0x0000000003310000-memory.dmpFilesize
64KB
-
memory/4684-4-0x0000000003430000-0x0000000003440000-memory.dmpFilesize
64KB
-
memory/4684-2-0x0000000003420000-0x000000000342E000-memory.dmpFilesize
56KB
-
memory/4684-3-0x0000000002D80000-0x0000000002D8E000-memory.dmpFilesize
56KB