Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/05/2021, 08:07
Static task
static1
Behavioral task
behavioral1
Sample
247f5c86_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
247f5c86_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 247f5c86_by_Libranalysis.exe
- Size 626KB
- Sample210505-tspbbjrhbj
- SHA256 fa4196a9d31f8e0f2dd479ed23945858008edf9bb367b6ad3ef29b7dadeb3472
- MD5 247f5c86b052aedb1f08ef998459fa60
- SHA1 53a01a7b7468e17b65b4b599f756c2424d105583
- SHA512 fcf2122f2f8f88130de4a1f9f8819935d04cf9ba5d3b9963b7d4767919871596d79bc247cf1a1269189db697cb8f6f7849824f7dc47613c55594de7cac36e243
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\JYkUMEwg\\VokUYEIk.exe," 247f5c86_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\JYkUMEwg\\VokUYEIk.exe," 247f5c86_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 3684 UAEIAsEo.exe 3036 VokUYEIk.exe 4200 GKsoUoAs.exe 580 chocolatey.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation UAEIAsEo.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\UAEIAsEo.exe = "C:\\Users\\Admin\\nCAgMscw\\UAEIAsEo.exe" 247f5c86_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VokUYEIk.exe = "C:\\ProgramData\\JYkUMEwg\\VokUYEIk.exe" 247f5c86_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\UAEIAsEo.exe = "C:\\Users\\Admin\\nCAgMscw\\UAEIAsEo.exe" UAEIAsEo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VokUYEIk.exe = "C:\\ProgramData\\JYkUMEwg\\VokUYEIk.exe" VokUYEIk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VokUYEIk.exe = "C:\\ProgramData\\JYkUMEwg\\VokUYEIk.exe" GKsoUoAs.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sheRequestConfirm.gif UAEIAsEo.exe File opened for modification C:\Windows\SysWOW64\sheTestEdit.jpg UAEIAsEo.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\nCAgMscw GKsoUoAs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\nCAgMscw\UAEIAsEo GKsoUoAs.exe File created C:\Windows\SysWOW64\shell32.dll.exe UAEIAsEo.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 3956 reg.exe 4048 reg.exe 4092 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4652 247f5c86_by_Libranalysis.exe 4652 247f5c86_by_Libranalysis.exe 4652 247f5c86_by_Libranalysis.exe 4652 247f5c86_by_Libranalysis.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3684 UAEIAsEo.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe 3684 UAEIAsEo.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4652 wrote to memory of 3684 4652 247f5c86_by_Libranalysis.exe 75 PID 4652 wrote to memory of 3684 4652 247f5c86_by_Libranalysis.exe 75 PID 4652 wrote to memory of 3684 4652 247f5c86_by_Libranalysis.exe 75 PID 4652 wrote to memory of 3036 4652 247f5c86_by_Libranalysis.exe 76 PID 4652 wrote to memory of 3036 4652 247f5c86_by_Libranalysis.exe 76 PID 4652 wrote to memory of 3036 4652 247f5c86_by_Libranalysis.exe 76 PID 4652 wrote to memory of 3240 4652 247f5c86_by_Libranalysis.exe 78 PID 4652 wrote to memory of 3240 4652 247f5c86_by_Libranalysis.exe 78 PID 4652 wrote to memory of 3240 4652 247f5c86_by_Libranalysis.exe 78 PID 4652 wrote to memory of 3956 4652 247f5c86_by_Libranalysis.exe 80 PID 4652 wrote to memory of 3956 4652 247f5c86_by_Libranalysis.exe 80 PID 4652 wrote to memory of 3956 4652 247f5c86_by_Libranalysis.exe 80 PID 4652 wrote to memory of 4048 4652 247f5c86_by_Libranalysis.exe 82 PID 4652 wrote to memory of 4048 4652 247f5c86_by_Libranalysis.exe 82 PID 4652 wrote to memory of 4048 4652 247f5c86_by_Libranalysis.exe 82 PID 4652 wrote to memory of 4092 4652 247f5c86_by_Libranalysis.exe 84 PID 4652 wrote to memory of 4092 4652 247f5c86_by_Libranalysis.exe 84 PID 4652 wrote to memory of 4092 4652 247f5c86_by_Libranalysis.exe 84 PID 3240 wrote to memory of 580 3240 cmd.exe 86 PID 3240 wrote to memory of 580 3240 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\247f5c86_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\247f5c86_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\nCAgMscw\UAEIAsEo.exe"C:\Users\Admin\nCAgMscw\UAEIAsEo.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3684
-
-
C:\ProgramData\JYkUMEwg\VokUYEIk.exe"C:\ProgramData\JYkUMEwg\VokUYEIk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3036
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\chocolatey.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\chocolatey.exeC:\Users\Admin\AppData\Local\Temp\chocolatey.exe3⤵
- Executes dropped EXE
PID:580
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:3956
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:4048
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:4092
-
-
C:\ProgramData\acAkEskQ\GKsoUoAs.exeC:\ProgramData\acAkEskQ\GKsoUoAs.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4200