Analysis
- max time kernel
151s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/05/2021, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
87e44356_by_Libranalysis.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
87e44356_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 87e44356_by_Libranalysis.exe
- Size 1.0MB
- Sample210505-ys55da647x
- SHA256 a1de40b9a49349b4010ef253917ca7cbeb8cad2789d5cc44fba5b0bf9ee666ee
- MD5 87e4435635d035dc7d3be4fcec9cc7c1
- SHA1 2cfadc79dc1ea29a56b3d89db85b087b01ff03a2
- SHA512 c7ccf0bd597b99055b7c9209fff2812fb46ddac9a5495cf86802989e2b23f13b3fe893a98e070f7f826df51331f2a8c7fb1eb727b0bd9ba0bda3e482c598902b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\fOossYcM\\MQokEEks.exe," 87e44356_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\fOossYcM\\MQokEEks.exe," 87e44356_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 1648 mmMEUgUo.exe 3276 MQokEEks.exe 2644 qMAAooso.exe 1312 Setup.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation MQokEEks.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MQokEEks.exe = "C:\\ProgramData\\fOossYcM\\MQokEEks.exe" qMAAooso.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mmMEUgUo.exe = "C:\\Users\\Admin\\foIIAAQw\\mmMEUgUo.exe" 87e44356_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MQokEEks.exe = "C:\\ProgramData\\fOossYcM\\MQokEEks.exe" 87e44356_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mmMEUgUo.exe = "C:\\Users\\Admin\\foIIAAQw\\mmMEUgUo.exe" mmMEUgUo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MQokEEks.exe = "C:\\ProgramData\\fOossYcM\\MQokEEks.exe" MQokEEks.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\foIIAAQw qMAAooso.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\foIIAAQw\mmMEUgUo qMAAooso.exe File created C:\Windows\SysWOW64\shell32.dll.exe MQokEEks.exe File opened for modification C:\Windows\SysWOW64\sheRenameExpand.docm MQokEEks.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 1432 reg.exe 2300 reg.exe 412 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 852 87e44356_by_Libranalysis.exe 852 87e44356_by_Libranalysis.exe 852 87e44356_by_Libranalysis.exe 852 87e44356_by_Libranalysis.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3276 MQokEEks.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe 3276 MQokEEks.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1312 Setup.exe 1312 Setup.exe 1312 Setup.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 852 wrote to memory of 1648 852 87e44356_by_Libranalysis.exe 75 PID 852 wrote to memory of 1648 852 87e44356_by_Libranalysis.exe 75 PID 852 wrote to memory of 1648 852 87e44356_by_Libranalysis.exe 75 PID 852 wrote to memory of 3276 852 87e44356_by_Libranalysis.exe 76 PID 852 wrote to memory of 3276 852 87e44356_by_Libranalysis.exe 76 PID 852 wrote to memory of 3276 852 87e44356_by_Libranalysis.exe 76 PID 852 wrote to memory of 192 852 87e44356_by_Libranalysis.exe 78 PID 852 wrote to memory of 192 852 87e44356_by_Libranalysis.exe 78 PID 852 wrote to memory of 192 852 87e44356_by_Libranalysis.exe 78 PID 852 wrote to memory of 412 852 87e44356_by_Libranalysis.exe 80 PID 852 wrote to memory of 412 852 87e44356_by_Libranalysis.exe 80 PID 852 wrote to memory of 412 852 87e44356_by_Libranalysis.exe 80 PID 852 wrote to memory of 2300 852 87e44356_by_Libranalysis.exe 83 PID 852 wrote to memory of 2300 852 87e44356_by_Libranalysis.exe 83 PID 852 wrote to memory of 2300 852 87e44356_by_Libranalysis.exe 83 PID 852 wrote to memory of 1432 852 87e44356_by_Libranalysis.exe 82 PID 852 wrote to memory of 1432 852 87e44356_by_Libranalysis.exe 82 PID 852 wrote to memory of 1432 852 87e44356_by_Libranalysis.exe 82 PID 192 wrote to memory of 1312 192 cmd.exe 86 PID 192 wrote to memory of 1312 192 cmd.exe 86 PID 192 wrote to memory of 1312 192 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\87e44356_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\87e44356_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\foIIAAQw\mmMEUgUo.exe"C:\Users\Admin\foIIAAQw\mmMEUgUo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1648
-
-
C:\ProgramData\fOossYcM\MQokEEks.exe"C:\ProgramData\fOossYcM\MQokEEks.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
- Suspicious use of WriteProcessMemory
PID:192 -
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1312
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:412
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:1432
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:2300
-
-
C:\ProgramData\vQwkAokI\qMAAooso.exeC:\ProgramData\vQwkAokI\qMAAooso.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2644