Analysis
- max time kernel
151s - max time network
113s - platform
windows7_x64 - resource
win7v20210410 - submitted
05/05/2021, 08:07
Static task
static1
Behavioral task
behavioral1
Sample
969cf84a_by_Libranalysis.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
969cf84a_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 969cf84a_by_Libranalysis.exe
- Size 627KB
- Sample210505-5bcrd23vs2
- SHA256 085a972774c849ad789ce702eed1c52156463bb630598e2e8b33a20913ba981a
- MD5 969cf84abd72093695ada824fb7bb899
- SHA1 a861b1ca2b07f3236c4b52a686338b1b616f1320
- SHA512 f93d59fc70af930a5f9dbd2d2e0d41af9db224f95d09f17f033749ee6557fd112f0ca0512898a0236cd74a92645c646acb8141fc8c550c52ef6ecd4f46df1332
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\rqkMwMoE\\ySEAQIAI.exe," 969cf84a_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\rqkMwMoE\\ySEAQIAI.exe," 969cf84a_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 844 ISAsQEUI.exe 1292 ySEAQIAI.exe 1768 hOAocIwI.exe 612 cuninst.exe - Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\UnprotectConvert.png.exe ISAsQEUI.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation ISAsQEUI.exe - Loads dropped DLL 19 IoCs
pid Process 1104 969cf84a_by_Libranalysis.exe 1104 969cf84a_by_Libranalysis.exe 1104 969cf84a_by_Libranalysis.exe 1104 969cf84a_by_Libranalysis.exe 1552 cmd.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ySEAQIAI.exe = "C:\\ProgramData\\rqkMwMoE\\ySEAQIAI.exe" ySEAQIAI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ySEAQIAI.exe = "C:\\ProgramData\\rqkMwMoE\\ySEAQIAI.exe" hOAocIwI.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ISAsQEUI.exe = "C:\\Users\\Admin\\eeksQYYs\\ISAsQEUI.exe" 969cf84a_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ySEAQIAI.exe = "C:\\ProgramData\\rqkMwMoE\\ySEAQIAI.exe" 969cf84a_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ISAsQEUI.exe = "C:\\Users\\Admin\\eeksQYYs\\ISAsQEUI.exe" ISAsQEUI.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\eeksQYYs hOAocIwI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\eeksQYYs\ISAsQEUI hOAocIwI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 1152 reg.exe 692 reg.exe 1480 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1104 969cf84a_by_Libranalysis.exe 1104 969cf84a_by_Libranalysis.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 844 ISAsQEUI.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe 844 ISAsQEUI.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1104 wrote to memory of 844 1104 969cf84a_by_Libranalysis.exe 26 PID 1104 wrote to memory of 844 1104 969cf84a_by_Libranalysis.exe 26 PID 1104 wrote to memory of 844 1104 969cf84a_by_Libranalysis.exe 26 PID 1104 wrote to memory of 844 1104 969cf84a_by_Libranalysis.exe 26 PID 1104 wrote to memory of 1292 1104 969cf84a_by_Libranalysis.exe 27 PID 1104 wrote to memory of 1292 1104 969cf84a_by_Libranalysis.exe 27 PID 1104 wrote to memory of 1292 1104 969cf84a_by_Libranalysis.exe 27 PID 1104 wrote to memory of 1292 1104 969cf84a_by_Libranalysis.exe 27 PID 1104 wrote to memory of 1552 1104 969cf84a_by_Libranalysis.exe 31 PID 1104 wrote to memory of 1552 1104 969cf84a_by_Libranalysis.exe 31 PID 1104 wrote to memory of 1552 1104 969cf84a_by_Libranalysis.exe 31 PID 1104 wrote to memory of 1552 1104 969cf84a_by_Libranalysis.exe 31 PID 1552 wrote to memory of 612 1552 cmd.exe 34 PID 1552 wrote to memory of 612 1552 cmd.exe 34 PID 1552 wrote to memory of 612 1552 cmd.exe 34 PID 1552 wrote to memory of 612 1552 cmd.exe 34 PID 1104 wrote to memory of 1480 1104 969cf84a_by_Libranalysis.exe 35 PID 1104 wrote to memory of 1480 1104 969cf84a_by_Libranalysis.exe 35 PID 1104 wrote to memory of 1480 1104 969cf84a_by_Libranalysis.exe 35 PID 1104 wrote to memory of 1480 1104 969cf84a_by_Libranalysis.exe 35 PID 1104 wrote to memory of 1152 1104 969cf84a_by_Libranalysis.exe 36 PID 1104 wrote to memory of 1152 1104 969cf84a_by_Libranalysis.exe 36 PID 1104 wrote to memory of 1152 1104 969cf84a_by_Libranalysis.exe 36 PID 1104 wrote to memory of 1152 1104 969cf84a_by_Libranalysis.exe 36 PID 1104 wrote to memory of 692 1104 969cf84a_by_Libranalysis.exe 38 PID 1104 wrote to memory of 692 1104 969cf84a_by_Libranalysis.exe 38 PID 1104 wrote to memory of 692 1104 969cf84a_by_Libranalysis.exe 38 PID 1104 wrote to memory of 692 1104 969cf84a_by_Libranalysis.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\969cf84a_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\969cf84a_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\eeksQYYs\ISAsQEUI.exe"C:\Users\Admin\eeksQYYs\ISAsQEUI.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:844
-
-
C:\ProgramData\rqkMwMoE\ySEAQIAI.exe"C:\ProgramData\rqkMwMoE\ySEAQIAI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1292
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cuninst.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\cuninst.exeC:\Users\Admin\AppData\Local\Temp\cuninst.exe3⤵
- Executes dropped EXE
PID:612
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:1480
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:1152
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:692
-
-
C:\ProgramData\NsAQckoI\hOAocIwI.exeC:\ProgramData\NsAQckoI\hOAocIwI.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1768