Analysis
- max time kernel
152s - max time network
148s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/05/2021, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
603e641b_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
603e641b_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 603e641b_by_Libranalysis.exe
- Size 1.6MB
- Sample210505-lcqaeecwfj
- SHA256 5dcbbdb1d5a8b47a50a05b2cf13963139075616f4b6de2db2232aa73bde800c1
- MD5 603e641b7747dcd7e27639dfb87e6942
- SHA1 c7893026f6c09a79edca1819170a7e8aa6dba560
- SHA512 61084c795c9eadeb00af6dbecadbb3b546a3c24081b9435a4ef1c9f5b4d70059f84ddf968008a9479317c06e62bc3fe6dbc995b5983fd7646bec298f6ae456ff
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\BIUkUAgU\\xMswgoQQ.exe," 603e641b_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\BIUkUAgU\\xMswgoQQ.exe," 603e641b_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 3200 JQcwMYsk.exe 3732 xMswgoQQ.exe 2428 ESAEgEoU.exe 2068 setup.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation JQcwMYsk.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\JQcwMYsk.exe = "C:\\Users\\Admin\\lSsIksgs\\JQcwMYsk.exe" 603e641b_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xMswgoQQ.exe = "C:\\ProgramData\\BIUkUAgU\\xMswgoQQ.exe" 603e641b_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\JQcwMYsk.exe = "C:\\Users\\Admin\\lSsIksgs\\JQcwMYsk.exe" JQcwMYsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xMswgoQQ.exe = "C:\\ProgramData\\BIUkUAgU\\xMswgoQQ.exe" xMswgoQQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xMswgoQQ.exe = "C:\\ProgramData\\BIUkUAgU\\xMswgoQQ.exe" ESAEgEoU.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\lSsIksgs ESAEgEoU.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\lSsIksgs\JQcwMYsk ESAEgEoU.exe File created C:\Windows\SysWOW64\shell32.dll.exe JQcwMYsk.exe File opened for modification C:\Windows\SysWOW64\sheUninstallWait.mpg JQcwMYsk.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 2208 reg.exe 1352 reg.exe 652 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 740 603e641b_by_Libranalysis.exe 740 603e641b_by_Libranalysis.exe 740 603e641b_by_Libranalysis.exe 740 603e641b_by_Libranalysis.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3200 JQcwMYsk.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe 3200 JQcwMYsk.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 740 wrote to memory of 3200 740 603e641b_by_Libranalysis.exe 75 PID 740 wrote to memory of 3200 740 603e641b_by_Libranalysis.exe 75 PID 740 wrote to memory of 3200 740 603e641b_by_Libranalysis.exe 75 PID 740 wrote to memory of 3732 740 603e641b_by_Libranalysis.exe 76 PID 740 wrote to memory of 3732 740 603e641b_by_Libranalysis.exe 76 PID 740 wrote to memory of 3732 740 603e641b_by_Libranalysis.exe 76 PID 740 wrote to memory of 208 740 603e641b_by_Libranalysis.exe 78 PID 740 wrote to memory of 208 740 603e641b_by_Libranalysis.exe 78 PID 740 wrote to memory of 208 740 603e641b_by_Libranalysis.exe 78 PID 740 wrote to memory of 2208 740 603e641b_by_Libranalysis.exe 80 PID 740 wrote to memory of 2208 740 603e641b_by_Libranalysis.exe 80 PID 740 wrote to memory of 2208 740 603e641b_by_Libranalysis.exe 80 PID 740 wrote to memory of 1352 740 603e641b_by_Libranalysis.exe 81 PID 740 wrote to memory of 1352 740 603e641b_by_Libranalysis.exe 81 PID 740 wrote to memory of 1352 740 603e641b_by_Libranalysis.exe 81 PID 740 wrote to memory of 652 740 603e641b_by_Libranalysis.exe 84 PID 740 wrote to memory of 652 740 603e641b_by_Libranalysis.exe 84 PID 740 wrote to memory of 652 740 603e641b_by_Libranalysis.exe 84 PID 208 wrote to memory of 2068 208 cmd.exe 86 PID 208 wrote to memory of 2068 208 cmd.exe 86 PID 208 wrote to memory of 2068 208 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\603e641b_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\603e641b_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\lSsIksgs\JQcwMYsk.exe"C:\Users\Admin\lSsIksgs\JQcwMYsk.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3200
-
-
C:\ProgramData\BIUkUAgU\xMswgoQQ.exe"C:\ProgramData\BIUkUAgU\xMswgoQQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\setup.exe2⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe3⤵
- Executes dropped EXE
PID:2068
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:2208
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:1352
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:652
-
-
C:\ProgramData\zSoEcYYw\ESAEgEoU.exeC:\ProgramData\zSoEcYYw\ESAEgEoU.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2428