Analysis
-
max time kernel
60s -
max time network
52s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-04-2021 06:02
Static task
static1
Behavioral task
behavioral1
Sample
APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe
Resource
win10v20201028
General
-
Target
APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe
-
Size
706KB
-
MD5
da60d646e63e252736a76998f36a6547
-
SHA1
ca9af1d7be7667784742ced9b33141d7c6a4e0ac
-
SHA256
b728133491571b5473adba573e27014ccd8a83a337549e1cd61bb53675d9af81
-
SHA512
d89798434962684006161403a3c41ba62232e379367211be59106d4369666cfb3dcc4c96de0e7bc7c6d162a0bda516976f061c7975c20623a3346c73e56dcea8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
FILES.exepid process 772 FILES.exe -
Loads dropped DLL 1 IoCs
Processes:
APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exepid process 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1800-64-0x0000000000B00000-0x0000000000B21000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\FILES = "C:\\Users\\Admin\\AppData\\Roaming\\FILES.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exeFILES.exepid process 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe 772 FILES.exe 772 FILES.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exeFILES.exedescription pid process Token: SeDebugPrivilege 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe Token: SeDebugPrivilege 772 FILES.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.execmd.exedescription pid process target process PID 1800 wrote to memory of 1572 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe cmd.exe PID 1800 wrote to memory of 1572 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe cmd.exe PID 1800 wrote to memory of 1572 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe cmd.exe PID 1800 wrote to memory of 1572 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe cmd.exe PID 1572 wrote to memory of 796 1572 cmd.exe reg.exe PID 1572 wrote to memory of 796 1572 cmd.exe reg.exe PID 1572 wrote to memory of 796 1572 cmd.exe reg.exe PID 1572 wrote to memory of 796 1572 cmd.exe reg.exe PID 1800 wrote to memory of 772 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe FILES.exe PID 1800 wrote to memory of 772 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe FILES.exe PID 1800 wrote to memory of 772 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe FILES.exe PID 1800 wrote to memory of 772 1800 APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe FILES.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe"C:\Users\Admin\AppData\Local\Temp\APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "FILES" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FILES.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "FILES" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FILES.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\FILES.exe"C:\Users\Admin\AppData\Roaming\FILES.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\FILES.exeMD5
da60d646e63e252736a76998f36a6547
SHA1ca9af1d7be7667784742ced9b33141d7c6a4e0ac
SHA256b728133491571b5473adba573e27014ccd8a83a337549e1cd61bb53675d9af81
SHA512d89798434962684006161403a3c41ba62232e379367211be59106d4369666cfb3dcc4c96de0e7bc7c6d162a0bda516976f061c7975c20623a3346c73e56dcea8
-
C:\Users\Admin\AppData\Roaming\FILES.exeMD5
da60d646e63e252736a76998f36a6547
SHA1ca9af1d7be7667784742ced9b33141d7c6a4e0ac
SHA256b728133491571b5473adba573e27014ccd8a83a337549e1cd61bb53675d9af81
SHA512d89798434962684006161403a3c41ba62232e379367211be59106d4369666cfb3dcc4c96de0e7bc7c6d162a0bda516976f061c7975c20623a3346c73e56dcea8
-
\Users\Admin\AppData\Roaming\FILES.exeMD5
da60d646e63e252736a76998f36a6547
SHA1ca9af1d7be7667784742ced9b33141d7c6a4e0ac
SHA256b728133491571b5473adba573e27014ccd8a83a337549e1cd61bb53675d9af81
SHA512d89798434962684006161403a3c41ba62232e379367211be59106d4369666cfb3dcc4c96de0e7bc7c6d162a0bda516976f061c7975c20623a3346c73e56dcea8
-
memory/772-69-0x0000000000000000-mapping.dmp
-
memory/772-72-0x0000000001120000-0x0000000001121000-memory.dmpFilesize
4KB
-
memory/772-74-0x0000000001010000-0x0000000001011000-memory.dmpFilesize
4KB
-
memory/772-77-0x0000000001011000-0x0000000001012000-memory.dmpFilesize
4KB
-
memory/796-67-0x0000000000000000-mapping.dmp
-
memory/1572-66-0x0000000000000000-mapping.dmp
-
memory/1800-65-0x0000000004B51000-0x0000000004B52000-memory.dmpFilesize
4KB
-
memory/1800-60-0x0000000001280000-0x0000000001281000-memory.dmpFilesize
4KB
-
memory/1800-64-0x0000000000B00000-0x0000000000B21000-memory.dmpFilesize
132KB
-
memory/1800-62-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB