Analysis
- max time kernel
151s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/05/2021, 08:07
Static task
static1
Behavioral task
behavioral1
Sample
969cf84a_by_Libranalysis.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
969cf84a_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 969cf84a_by_Libranalysis.exe
- Size 627KB
- Sample210505-5bcrd23vs2
- SHA256 085a972774c849ad789ce702eed1c52156463bb630598e2e8b33a20913ba981a
- MD5 969cf84abd72093695ada824fb7bb899
- SHA1 a861b1ca2b07f3236c4b52a686338b1b616f1320
- SHA512 f93d59fc70af930a5f9dbd2d2e0d41af9db224f95d09f17f033749ee6557fd112f0ca0512898a0236cd74a92645c646acb8141fc8c550c52ef6ecd4f46df1332
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\FSkYkUsU\\pCcsAgwQ.exe," 969cf84a_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\FSkYkUsU\\pCcsAgwQ.exe," 969cf84a_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 3156 kmIoowsA.exe 2560 pCcsAgwQ.exe 3232 qikwowkU.exe 1940 cuninst.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation pCcsAgwQ.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kmIoowsA.exe = "C:\\Users\\Admin\\TgIsoYAo\\kmIoowsA.exe" 969cf84a_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pCcsAgwQ.exe = "C:\\ProgramData\\FSkYkUsU\\pCcsAgwQ.exe" 969cf84a_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kmIoowsA.exe = "C:\\Users\\Admin\\TgIsoYAo\\kmIoowsA.exe" kmIoowsA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pCcsAgwQ.exe = "C:\\ProgramData\\FSkYkUsU\\pCcsAgwQ.exe" pCcsAgwQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pCcsAgwQ.exe = "C:\\ProgramData\\FSkYkUsU\\pCcsAgwQ.exe" qikwowkU.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe pCcsAgwQ.exe File opened for modification C:\Windows\SysWOW64\sheRestartInvoke.xlsm pCcsAgwQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\TgIsoYAo qikwowkU.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\TgIsoYAo\kmIoowsA qikwowkU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 2804 reg.exe 212 reg.exe 936 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 644 969cf84a_by_Libranalysis.exe 644 969cf84a_by_Libranalysis.exe 644 969cf84a_by_Libranalysis.exe 644 969cf84a_by_Libranalysis.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2560 pCcsAgwQ.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe 2560 pCcsAgwQ.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 644 wrote to memory of 3156 644 969cf84a_by_Libranalysis.exe 74 PID 644 wrote to memory of 3156 644 969cf84a_by_Libranalysis.exe 74 PID 644 wrote to memory of 3156 644 969cf84a_by_Libranalysis.exe 74 PID 644 wrote to memory of 2560 644 969cf84a_by_Libranalysis.exe 76 PID 644 wrote to memory of 2560 644 969cf84a_by_Libranalysis.exe 76 PID 644 wrote to memory of 2560 644 969cf84a_by_Libranalysis.exe 76 PID 644 wrote to memory of 572 644 969cf84a_by_Libranalysis.exe 78 PID 644 wrote to memory of 572 644 969cf84a_by_Libranalysis.exe 78 PID 644 wrote to memory of 572 644 969cf84a_by_Libranalysis.exe 78 PID 644 wrote to memory of 2804 644 969cf84a_by_Libranalysis.exe 80 PID 644 wrote to memory of 2804 644 969cf84a_by_Libranalysis.exe 80 PID 644 wrote to memory of 2804 644 969cf84a_by_Libranalysis.exe 80 PID 644 wrote to memory of 212 644 969cf84a_by_Libranalysis.exe 81 PID 644 wrote to memory of 212 644 969cf84a_by_Libranalysis.exe 81 PID 644 wrote to memory of 212 644 969cf84a_by_Libranalysis.exe 81 PID 644 wrote to memory of 936 644 969cf84a_by_Libranalysis.exe 83 PID 644 wrote to memory of 936 644 969cf84a_by_Libranalysis.exe 83 PID 644 wrote to memory of 936 644 969cf84a_by_Libranalysis.exe 83 PID 572 wrote to memory of 1940 572 cmd.exe 85 PID 572 wrote to memory of 1940 572 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\969cf84a_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\969cf84a_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\TgIsoYAo\kmIoowsA.exe"C:\Users\Admin\TgIsoYAo\kmIoowsA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3156
-
-
C:\ProgramData\FSkYkUsU\pCcsAgwQ.exe"C:\ProgramData\FSkYkUsU\pCcsAgwQ.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cuninst.exe2⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\cuninst.exeC:\Users\Admin\AppData\Local\Temp\cuninst.exe3⤵
- Executes dropped EXE
PID:1940
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:2804
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:212
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:936
-
-
C:\ProgramData\qwYcMIsY\qikwowkU.exeC:\ProgramData\qwYcMIsY\qikwowkU.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3232