Overview

overview

8

Static

static

updated.exe

windows7_x64

1

updated.exe

windows10_x64

8

Resubmissions

06-04-2021 16:38

210406-pa5tpj4bra 8

05-04-2021 09:13

210405-ald3l915jn 10

Analysis

  • max time kernel
    134s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    06-04-2021 16:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    updated.exe

  • Size

    5.1MB

  • MD5

    e3749a1c5284b28ad7ded54ed747b6e0

  • SHA1

    c516f5af4ab59ec6750ac86d11f06ee1dd47a1dd

  • SHA256

    430039aeee4362784600b6b6994b72395c2666aa6d1ad30e6cbf1ed89ecbeaa9

  • SHA512

    acd1911e755d715b7c96ea278a6f4ea039884a85ac230913b1bd85b3f1ab6e322d9cbe9e9869a4c9eeeb5460ebeca9591b5e64d48789ded45d8bc0168ec22bb4

Score
8/10
ransomwarespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 27 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 41 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\updated.exe
    "C:\Users\Admin\AppData\Local\Temp\updated.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Windows\SysWOW64\mode.com
      mode con cp select=125 vssadmin delete shadows /all
      2⤵
        PID:3292
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im msaccess.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4164
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im sqlagent.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4148
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im mspub.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3140
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im ocssd.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3048
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im tbirdconfig.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:676
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im sqlbrowser.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:880
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im mydesktopqos.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:376
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im dbsnmp.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1188
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im thebat64.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1388
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im thunderdird.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1528
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im sqbcoreservice.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1720
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im encsvc.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1692
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im winword.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:312
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im dbeng50.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2120
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im ocomm.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1736
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im ocautoupds.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4480
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im firefoxconfig.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2564
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im visio.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2312
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im sqlservr.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3864
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im infopath.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2864
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im thebat.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2640
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im excel.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:228
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im mysqld.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2184
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im sqlserver.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1564
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im powerpnt.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4552
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im msftesql.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4940
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im xfsssvccon.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3976
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im notepad.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2780
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im outlook.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4308
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im onenote.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:60
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im notepad++.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:752
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im synctime.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im agntsvc.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4192
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im sqlwriter.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4756
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im mysql-nt.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2160
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im wordpad.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2132
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im isqlplussvc.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3288
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im mydesktopservice.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3284
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im oracle.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1128
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im steam.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2208
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill.exe /f /im mysql-opt.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1976
      • C:\Windows\SysWOW64\mode.com
        mode con cp select=125 vssadmin delete shadows /all
        2⤵
          PID:4168

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4640-2-0x0000000000400000-0x000000000092D000-memory.dmp

        Filesize

        5.2MB

        Download