Analysis
- max time kernel
151s - max time network
93s - platform
windows7_x64 - resource
win7v20210408 - submitted
05/05/2021, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
399a5bb2_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
399a5bb2_by_Libranalysis.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 399a5bb2_by_Libranalysis.exe
- Size 749KB
- Sample210505-rmn11aml5j
- SHA256 4bd8ca7a186343d59945c7258608115dceecb2da70ee94391774ff5f3f6e189f
- MD5 399a5bb2c92b73c1bdabb0307ca24ee5
- SHA1 3ee0dc50a5b1ada2d90b6a96776934d91758491c
- SHA512 b60e72c7eac0527ff51a8ba355955114d4c59f492c6f0aca2e87798f025c0b46d0273da4bf0260a7a02edc7974f39abd895b935ddebe4d242ecf633b9a3a8e5c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\zwkIwQQE\\oyUwoggQ.exe," 399a5bb2_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\zwkIwQQE\\oyUwoggQ.exe," 399a5bb2_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 1932 MsEcMgIU.exe 1936 oyUwoggQ.exe 1860 esQYUIUg.exe 1976 chocolatey.exe - Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\OutJoin.png.exe MsEcMgIU.exe File created C:\Users\Admin\Pictures\PublishOut.png.exe MsEcMgIU.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation MsEcMgIU.exe - Loads dropped DLL 17 IoCs
pid Process 1640 399a5bb2_by_Libranalysis.exe 1640 399a5bb2_by_Libranalysis.exe 1640 399a5bb2_by_Libranalysis.exe 1640 399a5bb2_by_Libranalysis.exe 2020 cmd.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\MsEcMgIU.exe = "C:\\Users\\Admin\\XGYAEUQw\\MsEcMgIU.exe" 399a5bb2_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oyUwoggQ.exe = "C:\\ProgramData\\zwkIwQQE\\oyUwoggQ.exe" 399a5bb2_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\MsEcMgIU.exe = "C:\\Users\\Admin\\XGYAEUQw\\MsEcMgIU.exe" MsEcMgIU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oyUwoggQ.exe = "C:\\ProgramData\\zwkIwQQE\\oyUwoggQ.exe" oyUwoggQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oyUwoggQ.exe = "C:\\ProgramData\\zwkIwQQE\\oyUwoggQ.exe" esQYUIUg.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\XGYAEUQw esQYUIUg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\XGYAEUQw\MsEcMgIU esQYUIUg.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico MsEcMgIU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 828 reg.exe 1228 reg.exe 2028 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1640 399a5bb2_by_Libranalysis.exe 1640 399a5bb2_by_Libranalysis.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1932 MsEcMgIU.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe 1932 MsEcMgIU.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1932 1640 399a5bb2_by_Libranalysis.exe 26 PID 1640 wrote to memory of 1932 1640 399a5bb2_by_Libranalysis.exe 26 PID 1640 wrote to memory of 1932 1640 399a5bb2_by_Libranalysis.exe 26 PID 1640 wrote to memory of 1932 1640 399a5bb2_by_Libranalysis.exe 26 PID 1640 wrote to memory of 1936 1640 399a5bb2_by_Libranalysis.exe 27 PID 1640 wrote to memory of 1936 1640 399a5bb2_by_Libranalysis.exe 27 PID 1640 wrote to memory of 1936 1640 399a5bb2_by_Libranalysis.exe 27 PID 1640 wrote to memory of 1936 1640 399a5bb2_by_Libranalysis.exe 27 PID 1640 wrote to memory of 2020 1640 399a5bb2_by_Libranalysis.exe 29 PID 1640 wrote to memory of 2020 1640 399a5bb2_by_Libranalysis.exe 29 PID 1640 wrote to memory of 2020 1640 399a5bb2_by_Libranalysis.exe 29 PID 1640 wrote to memory of 2020 1640 399a5bb2_by_Libranalysis.exe 29 PID 2020 wrote to memory of 1976 2020 cmd.exe 31 PID 2020 wrote to memory of 1976 2020 cmd.exe 31 PID 2020 wrote to memory of 1976 2020 cmd.exe 31 PID 2020 wrote to memory of 1976 2020 cmd.exe 31 PID 1640 wrote to memory of 1228 1640 399a5bb2_by_Libranalysis.exe 32 PID 1640 wrote to memory of 1228 1640 399a5bb2_by_Libranalysis.exe 32 PID 1640 wrote to memory of 1228 1640 399a5bb2_by_Libranalysis.exe 32 PID 1640 wrote to memory of 1228 1640 399a5bb2_by_Libranalysis.exe 32 PID 1640 wrote to memory of 2028 1640 399a5bb2_by_Libranalysis.exe 34 PID 1640 wrote to memory of 2028 1640 399a5bb2_by_Libranalysis.exe 34 PID 1640 wrote to memory of 2028 1640 399a5bb2_by_Libranalysis.exe 34 PID 1640 wrote to memory of 2028 1640 399a5bb2_by_Libranalysis.exe 34 PID 1640 wrote to memory of 828 1640 399a5bb2_by_Libranalysis.exe 35 PID 1640 wrote to memory of 828 1640 399a5bb2_by_Libranalysis.exe 35 PID 1640 wrote to memory of 828 1640 399a5bb2_by_Libranalysis.exe 35 PID 1640 wrote to memory of 828 1640 399a5bb2_by_Libranalysis.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\399a5bb2_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\399a5bb2_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\XGYAEUQw\MsEcMgIU.exe"C:\Users\Admin\XGYAEUQw\MsEcMgIU.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1932
-
-
C:\ProgramData\zwkIwQQE\oyUwoggQ.exe"C:\ProgramData\zwkIwQQE\oyUwoggQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1936
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\chocolatey.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\chocolatey.exeC:\Users\Admin\AppData\Local\Temp\chocolatey.exe3⤵
- Executes dropped EXE
PID:1976
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:1228
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:2028
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:828
-
-
C:\ProgramData\muEYokkA\esQYUIUg.exeC:\ProgramData\muEYokkA\esQYUIUg.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1860