Analysis
- max time kernel
150s - max time network
126s - platform
windows7_x64 - resource
win7v20210410 - submitted
05/05/2021, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
87e44356_by_Libranalysis.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
87e44356_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 87e44356_by_Libranalysis.exe
- Size 1.0MB
- Sample210505-ys55da647x
- SHA256 a1de40b9a49349b4010ef253917ca7cbeb8cad2789d5cc44fba5b0bf9ee666ee
- MD5 87e4435635d035dc7d3be4fcec9cc7c1
- SHA1 2cfadc79dc1ea29a56b3d89db85b087b01ff03a2
- SHA512 c7ccf0bd597b99055b7c9209fff2812fb46ddac9a5495cf86802989e2b23f13b3fe893a98e070f7f826df51331f2a8c7fb1eb727b0bd9ba0bda3e482c598902b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\qIQsIsgA\\MyoAIoEc.exe," 87e44356_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\qIQsIsgA\\MyoAIoEc.exe," 87e44356_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 1172 FYgAQsQM.exe 1988 MyoAIoEc.exe 1356 ViEkYoIc.exe 1476 Setup.exe - Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\UnprotectConvert.png.exe FYgAQsQM.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation FYgAQsQM.exe - Loads dropped DLL 17 IoCs
pid Process 1104 87e44356_by_Libranalysis.exe 1104 87e44356_by_Libranalysis.exe 1104 87e44356_by_Libranalysis.exe 1104 87e44356_by_Libranalysis.exe 1552 cmd.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MyoAIoEc.exe = "C:\\ProgramData\\qIQsIsgA\\MyoAIoEc.exe" 87e44356_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\FYgAQsQM.exe = "C:\\Users\\Admin\\BwsEoAQw\\FYgAQsQM.exe" FYgAQsQM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MyoAIoEc.exe = "C:\\ProgramData\\qIQsIsgA\\MyoAIoEc.exe" MyoAIoEc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MyoAIoEc.exe = "C:\\ProgramData\\qIQsIsgA\\MyoAIoEc.exe" ViEkYoIc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\FYgAQsQM.exe = "C:\\Users\\Admin\\BwsEoAQw\\FYgAQsQM.exe" 87e44356_by_Libranalysis.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\BwsEoAQw ViEkYoIc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\BwsEoAQw\FYgAQsQM ViEkYoIc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 368 reg.exe 760 reg.exe 396 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1104 87e44356_by_Libranalysis.exe 1104 87e44356_by_Libranalysis.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1172 FYgAQsQM.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe 1172 FYgAQsQM.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1476 Setup.exe 1476 Setup.exe 1476 Setup.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1104 wrote to memory of 1172 1104 87e44356_by_Libranalysis.exe 26 PID 1104 wrote to memory of 1172 1104 87e44356_by_Libranalysis.exe 26 PID 1104 wrote to memory of 1172 1104 87e44356_by_Libranalysis.exe 26 PID 1104 wrote to memory of 1172 1104 87e44356_by_Libranalysis.exe 26 PID 1104 wrote to memory of 1988 1104 87e44356_by_Libranalysis.exe 27 PID 1104 wrote to memory of 1988 1104 87e44356_by_Libranalysis.exe 27 PID 1104 wrote to memory of 1988 1104 87e44356_by_Libranalysis.exe 27 PID 1104 wrote to memory of 1988 1104 87e44356_by_Libranalysis.exe 27 PID 1104 wrote to memory of 1552 1104 87e44356_by_Libranalysis.exe 30 PID 1104 wrote to memory of 1552 1104 87e44356_by_Libranalysis.exe 30 PID 1104 wrote to memory of 1552 1104 87e44356_by_Libranalysis.exe 30 PID 1104 wrote to memory of 1552 1104 87e44356_by_Libranalysis.exe 30 PID 1104 wrote to memory of 368 1104 87e44356_by_Libranalysis.exe 33 PID 1104 wrote to memory of 368 1104 87e44356_by_Libranalysis.exe 33 PID 1104 wrote to memory of 368 1104 87e44356_by_Libranalysis.exe 33 PID 1104 wrote to memory of 368 1104 87e44356_by_Libranalysis.exe 33 PID 1104 wrote to memory of 760 1104 87e44356_by_Libranalysis.exe 35 PID 1104 wrote to memory of 760 1104 87e44356_by_Libranalysis.exe 35 PID 1104 wrote to memory of 760 1104 87e44356_by_Libranalysis.exe 35 PID 1104 wrote to memory of 760 1104 87e44356_by_Libranalysis.exe 35 PID 1104 wrote to memory of 396 1104 87e44356_by_Libranalysis.exe 36 PID 1104 wrote to memory of 396 1104 87e44356_by_Libranalysis.exe 36 PID 1104 wrote to memory of 396 1104 87e44356_by_Libranalysis.exe 36 PID 1104 wrote to memory of 396 1104 87e44356_by_Libranalysis.exe 36 PID 1552 wrote to memory of 1476 1552 cmd.exe 32 PID 1552 wrote to memory of 1476 1552 cmd.exe 32 PID 1552 wrote to memory of 1476 1552 cmd.exe 32 PID 1552 wrote to memory of 1476 1552 cmd.exe 32 PID 1552 wrote to memory of 1476 1552 cmd.exe 32 PID 1552 wrote to memory of 1476 1552 cmd.exe 32 PID 1552 wrote to memory of 1476 1552 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\87e44356_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\87e44356_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\BwsEoAQw\FYgAQsQM.exe"C:\Users\Admin\BwsEoAQw\FYgAQsQM.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1172
-
-
C:\ProgramData\qIQsIsgA\MyoAIoEc.exe"C:\ProgramData\qIQsIsgA\MyoAIoEc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1988
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1476
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:368
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:760
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:396
-
-
C:\ProgramData\QSMUIYUM\ViEkYoIc.exeC:\ProgramData\QSMUIYUM\ViEkYoIc.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1356