Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-05-2021 21:29
General
-
Target
a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe
-
Size
834KB
-
MD5
63d23949144c09b33cd549e2fbd692da
-
SHA1
c2090ce4c360783151a34b89fe6c17470a73bf21
-
SHA256
a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d
-
SHA512
c4735fef33fc054ffd73ffed9df93893dda125229cc17cfcbf1cd968abf6e3a7746f2c9752d4c5b971824627b950907a2916cf9d20839a03ea0a7545ee20f5c1
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 2 IoCs
-
Suspicious Office macro 1 IoCs
Office document equipped with macros.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe"C:\Users\Admin\AppData\Local\Temp\a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe"C:\Users\Admin\AppData\Local\Temp\._cache_a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc create zillut binpath= C:\Windows\KodeMonL.sys type= kernel & sc start zillut3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc create zillut binpath= C:\Windows\KodeMonL.sys type= kernel4⤵
-
C:\Windows\SysWOW64\sc.exesc start zillut4⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
d1be37912cb77d7c99b6eedcc490c274
SHA1969f26b526b8d961581710f51991601cc3506e71
SHA2567af850627b2fc57ea8302d1606785d2c29f693e558fe6be5f51326e51434e412
SHA512a4b06c9a669ce7cf0804669be3af504323aeffe1914d4d2b22994d1bf37b41c579ec575bda57bf28fbbe7818aeb26d8786b520e2e8d2231dcc2585f7c35c26e4
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
d1be37912cb77d7c99b6eedcc490c274
SHA1969f26b526b8d961581710f51991601cc3506e71
SHA2567af850627b2fc57ea8302d1606785d2c29f693e558fe6be5f51326e51434e412
SHA512a4b06c9a669ce7cf0804669be3af504323aeffe1914d4d2b22994d1bf37b41c579ec575bda57bf28fbbe7818aeb26d8786b520e2e8d2231dcc2585f7c35c26e4
-
C:\Users\Admin\AppData\Local\Temp\._cache_a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exeMD5
df8fd99187d89cbfb5c30766cf37ffe5
SHA132405616f7c291b44b844b4ccbd3667cc596a622
SHA256d70a79d4bbb7d32cc4e71f7bd245faaa46581fa2fcd5724fd96a9ad171c9e3cb
SHA512e510d2483d2e1b7db73e0cc8a46cb321a75a9ba94a964feaaebc485ae1729e8d1c911ff4d3618f54ecf8104548fbd9be3ba4e2e1aedd6fcfca4c89cde7758cf9
-
C:\Users\Admin\AppData\Local\Temp\._cache_a9dcd6d87c80da090a059e31bcd02cb21107fd09e8ade76f38dfbcbcf8bfc99d.exeMD5
df8fd99187d89cbfb5c30766cf37ffe5
SHA132405616f7c291b44b844b4ccbd3667cc596a622
SHA256d70a79d4bbb7d32cc4e71f7bd245faaa46581fa2fcd5724fd96a9ad171c9e3cb
SHA512e510d2483d2e1b7db73e0cc8a46cb321a75a9ba94a964feaaebc485ae1729e8d1c911ff4d3618f54ecf8104548fbd9be3ba4e2e1aedd6fcfca4c89cde7758cf9
-
C:\Users\Admin\AppData\Local\Temp\BCKMc3ft.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
memory/1308-127-0x0000000000000000-mapping.dmp
-
memory/1340-132-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/1340-131-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/1340-124-0x00007FF6DEF30000-0x00007FF6E24E6000-memory.dmpFilesize
53.7MB
-
memory/1340-137-0x00007FF878C60000-0x00007FF87AB55000-memory.dmpFilesize
31.0MB
-
memory/1340-135-0x00007FF87AB60000-0x00007FF87BC4E000-memory.dmpFilesize
16.9MB
-
memory/1340-130-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/1340-136-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/1340-129-0x00007FF85A170000-0x00007FF85A180000-memory.dmpFilesize
64KB
-
memory/1600-126-0x0000000000000000-mapping.dmp
-
memory/2612-115-0x0000000000000000-mapping.dmp
-
memory/3348-128-0x0000000000000000-mapping.dmp
-
memory/3680-114-0x0000000002210000-0x0000000002211000-memory.dmpFilesize
4KB
-
memory/3932-125-0x00000000004C0000-0x000000000056E000-memory.dmpFilesize
696KB
-
memory/3932-121-0x0000000000000000-mapping.dmp