Analysis
- max time kernel
152s - max time network
106s - platform
windows7_x64 - resource
win7v20210408 - submitted
05/05/2021, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
ed8c66bd_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ed8c66bd_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target ed8c66bd_by_Libranalysis.exe
- Size 626KB
- Sample210505-rah9jee4ke
- SHA256 0fdbe9d827930dcc2fa71ac6db6a187d1c7803cc6945ed577aa28af55ef0e9a2
- MD5 ed8c66bde2982acf093954409161d461
- SHA1 e6230962c1b0c20cbacd35b7e076605338d69491
- SHA512 00a48822814c6d4b6adbd02bc3de78dbf936e07dfb605683b621956b42cf6ecf1c2d656007f304f5e72a317a6a87e5bd5d01be04a7344124c58ecac6f0368788
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\JQUIMcos\\hmQIcUQI.exe," ed8c66bd_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\JQUIMcos\\hmQIcUQI.exe," ed8c66bd_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 1992 kmswIgcw.exe 2016 hmQIcUQI.exe 1944 KQwEgUMQ.exe 1000 cpack.exe - Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\RenameSearch.png.exe kmswIgcw.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation kmswIgcw.exe - Loads dropped DLL 21 IoCs
pid Process 980 ed8c66bd_by_Libranalysis.exe 980 ed8c66bd_by_Libranalysis.exe 980 ed8c66bd_by_Libranalysis.exe 980 ed8c66bd_by_Libranalysis.exe 564 cmd.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hmQIcUQI.exe = "C:\\ProgramData\\JQUIMcos\\hmQIcUQI.exe" hmQIcUQI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hmQIcUQI.exe = "C:\\ProgramData\\JQUIMcos\\hmQIcUQI.exe" KQwEgUMQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\kmswIgcw.exe = "C:\\Users\\Admin\\zQskcQco\\kmswIgcw.exe" ed8c66bd_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hmQIcUQI.exe = "C:\\ProgramData\\JQUIMcos\\hmQIcUQI.exe" ed8c66bd_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\kmswIgcw.exe = "C:\\Users\\Admin\\zQskcQco\\kmswIgcw.exe" kmswIgcw.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\zQskcQco KQwEgUMQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\zQskcQco\kmswIgcw KQwEgUMQ.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico kmswIgcw.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 1784 reg.exe 1776 reg.exe 1704 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 980 ed8c66bd_by_Libranalysis.exe 980 ed8c66bd_by_Libranalysis.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1992 kmswIgcw.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe 1992 kmswIgcw.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 980 wrote to memory of 1992 980 ed8c66bd_by_Libranalysis.exe 26 PID 980 wrote to memory of 1992 980 ed8c66bd_by_Libranalysis.exe 26 PID 980 wrote to memory of 1992 980 ed8c66bd_by_Libranalysis.exe 26 PID 980 wrote to memory of 1992 980 ed8c66bd_by_Libranalysis.exe 26 PID 980 wrote to memory of 2016 980 ed8c66bd_by_Libranalysis.exe 27 PID 980 wrote to memory of 2016 980 ed8c66bd_by_Libranalysis.exe 27 PID 980 wrote to memory of 2016 980 ed8c66bd_by_Libranalysis.exe 27 PID 980 wrote to memory of 2016 980 ed8c66bd_by_Libranalysis.exe 27 PID 980 wrote to memory of 564 980 ed8c66bd_by_Libranalysis.exe 29 PID 980 wrote to memory of 564 980 ed8c66bd_by_Libranalysis.exe 29 PID 980 wrote to memory of 564 980 ed8c66bd_by_Libranalysis.exe 29 PID 980 wrote to memory of 564 980 ed8c66bd_by_Libranalysis.exe 29 PID 564 wrote to memory of 1000 564 cmd.exe 31 PID 564 wrote to memory of 1000 564 cmd.exe 31 PID 564 wrote to memory of 1000 564 cmd.exe 31 PID 564 wrote to memory of 1000 564 cmd.exe 31 PID 980 wrote to memory of 1784 980 ed8c66bd_by_Libranalysis.exe 32 PID 980 wrote to memory of 1784 980 ed8c66bd_by_Libranalysis.exe 32 PID 980 wrote to memory of 1784 980 ed8c66bd_by_Libranalysis.exe 32 PID 980 wrote to memory of 1784 980 ed8c66bd_by_Libranalysis.exe 32 PID 980 wrote to memory of 1776 980 ed8c66bd_by_Libranalysis.exe 34 PID 980 wrote to memory of 1776 980 ed8c66bd_by_Libranalysis.exe 34 PID 980 wrote to memory of 1776 980 ed8c66bd_by_Libranalysis.exe 34 PID 980 wrote to memory of 1776 980 ed8c66bd_by_Libranalysis.exe 34 PID 980 wrote to memory of 1704 980 ed8c66bd_by_Libranalysis.exe 35 PID 980 wrote to memory of 1704 980 ed8c66bd_by_Libranalysis.exe 35 PID 980 wrote to memory of 1704 980 ed8c66bd_by_Libranalysis.exe 35 PID 980 wrote to memory of 1704 980 ed8c66bd_by_Libranalysis.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed8c66bd_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\ed8c66bd_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\zQskcQco\kmswIgcw.exe"C:\Users\Admin\zQskcQco\kmswIgcw.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1992
-
-
C:\ProgramData\JQUIMcos\hmQIcUQI.exe"C:\ProgramData\JQUIMcos\hmQIcUQI.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2016
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cpack.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\cpack.exeC:\Users\Admin\AppData\Local\Temp\cpack.exe3⤵
- Executes dropped EXE
PID:1000
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:1784
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:1776
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:1704
-
-
C:\ProgramData\pmAoEIkM\KQwEgUMQ.exeC:\ProgramData\pmAoEIkM\KQwEgUMQ.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1944