Analysis
- max time kernel
153s - max time network
108s - platform
windows7_x64 - resource
win7v20210408 - submitted
05/05/2021, 08:07
Static task
static1
Behavioral task
behavioral1
Sample
247f5c86_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
247f5c86_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 247f5c86_by_Libranalysis.exe
- Size 626KB
- Sample210505-tspbbjrhbj
- SHA256 fa4196a9d31f8e0f2dd479ed23945858008edf9bb367b6ad3ef29b7dadeb3472
- MD5 247f5c86b052aedb1f08ef998459fa60
- SHA1 53a01a7b7468e17b65b4b599f756c2424d105583
- SHA512 fcf2122f2f8f88130de4a1f9f8819935d04cf9ba5d3b9963b7d4767919871596d79bc247cf1a1269189db697cb8f6f7849824f7dc47613c55594de7cac36e243
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\DgMkEMUg\\QaYAsYUs.exe," 247f5c86_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\DgMkEMUg\\QaYAsYUs.exe," 247f5c86_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 2040 YCskIQYQ.exe 1184 QaYAsYUs.exe 1356 NkckYckQ.exe 1460 chocolatey.exe - Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\RenamePublish.png.exe QaYAsYUs.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation QaYAsYUs.exe - Loads dropped DLL 19 IoCs
pid Process 1628 247f5c86_by_Libranalysis.exe 1628 247f5c86_by_Libranalysis.exe 1628 247f5c86_by_Libranalysis.exe 1628 247f5c86_by_Libranalysis.exe 1964 cmd.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\YCskIQYQ.exe = "C:\\Users\\Admin\\bgoEYIkY\\YCskIQYQ.exe" 247f5c86_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QaYAsYUs.exe = "C:\\ProgramData\\DgMkEMUg\\QaYAsYUs.exe" 247f5c86_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\YCskIQYQ.exe = "C:\\Users\\Admin\\bgoEYIkY\\YCskIQYQ.exe" YCskIQYQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QaYAsYUs.exe = "C:\\ProgramData\\DgMkEMUg\\QaYAsYUs.exe" QaYAsYUs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QaYAsYUs.exe = "C:\\ProgramData\\DgMkEMUg\\QaYAsYUs.exe" NkckYckQ.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\bgoEYIkY NkckYckQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\bgoEYIkY\YCskIQYQ NkckYckQ.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico QaYAsYUs.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 1820 reg.exe 1652 reg.exe 316 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1628 247f5c86_by_Libranalysis.exe 1628 247f5c86_by_Libranalysis.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1184 QaYAsYUs.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe 1184 QaYAsYUs.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2040 1628 247f5c86_by_Libranalysis.exe 26 PID 1628 wrote to memory of 2040 1628 247f5c86_by_Libranalysis.exe 26 PID 1628 wrote to memory of 2040 1628 247f5c86_by_Libranalysis.exe 26 PID 1628 wrote to memory of 2040 1628 247f5c86_by_Libranalysis.exe 26 PID 1628 wrote to memory of 1184 1628 247f5c86_by_Libranalysis.exe 27 PID 1628 wrote to memory of 1184 1628 247f5c86_by_Libranalysis.exe 27 PID 1628 wrote to memory of 1184 1628 247f5c86_by_Libranalysis.exe 27 PID 1628 wrote to memory of 1184 1628 247f5c86_by_Libranalysis.exe 27 PID 1628 wrote to memory of 1964 1628 247f5c86_by_Libranalysis.exe 29 PID 1628 wrote to memory of 1964 1628 247f5c86_by_Libranalysis.exe 29 PID 1628 wrote to memory of 1964 1628 247f5c86_by_Libranalysis.exe 29 PID 1628 wrote to memory of 1964 1628 247f5c86_by_Libranalysis.exe 29 PID 1964 wrote to memory of 1460 1964 cmd.exe 32 PID 1964 wrote to memory of 1460 1964 cmd.exe 32 PID 1964 wrote to memory of 1460 1964 cmd.exe 32 PID 1964 wrote to memory of 1460 1964 cmd.exe 32 PID 1628 wrote to memory of 1820 1628 247f5c86_by_Libranalysis.exe 31 PID 1628 wrote to memory of 1820 1628 247f5c86_by_Libranalysis.exe 31 PID 1628 wrote to memory of 1820 1628 247f5c86_by_Libranalysis.exe 31 PID 1628 wrote to memory of 1820 1628 247f5c86_by_Libranalysis.exe 31 PID 1628 wrote to memory of 1652 1628 247f5c86_by_Libranalysis.exe 33 PID 1628 wrote to memory of 1652 1628 247f5c86_by_Libranalysis.exe 33 PID 1628 wrote to memory of 1652 1628 247f5c86_by_Libranalysis.exe 33 PID 1628 wrote to memory of 1652 1628 247f5c86_by_Libranalysis.exe 33 PID 1628 wrote to memory of 316 1628 247f5c86_by_Libranalysis.exe 34 PID 1628 wrote to memory of 316 1628 247f5c86_by_Libranalysis.exe 34 PID 1628 wrote to memory of 316 1628 247f5c86_by_Libranalysis.exe 34 PID 1628 wrote to memory of 316 1628 247f5c86_by_Libranalysis.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\247f5c86_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\247f5c86_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\bgoEYIkY\YCskIQYQ.exe"C:\Users\Admin\bgoEYIkY\YCskIQYQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2040
-
-
C:\ProgramData\DgMkEMUg\QaYAsYUs.exe"C:\ProgramData\DgMkEMUg\QaYAsYUs.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1184
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\chocolatey.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\chocolatey.exeC:\Users\Admin\AppData\Local\Temp\chocolatey.exe3⤵
- Executes dropped EXE
PID:1460
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:1820
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:1652
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:316
-
-
C:\ProgramData\rwsgMkAk\NkckYckQ.exeC:\ProgramData\rwsgMkAk\NkckYckQ.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1356