Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
14/05/2021, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
66D7C25E25D943FF9972AD4E2821A586.exe
Resource
win7v20210410
General
-
Target
66D7C25E25D943FF9972AD4E2821A586.exe
-
Size
1.9MB
-
MD5
66d7c25e25d943ff9972ad4e2821a586
-
SHA1
1c2f71afa6f6e13dd5939f4cad875aad33902627
-
SHA256
41f2e8b68fe406f818f0ab48067d967cc0a3430a9ddb97a191b3fca163b756ab
-
SHA512
18d40773115c4bf9a80c1b91c04b0a58eeb69f8c9b25da68dcfcb92e3d532ba09d2aa6a278d6e0891e19e3e572ba1c77efe422189bd9b752ce770609904ac76f
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
pid Process 2108 Ove.exe.com 3776 Ove.exe.com 748 ysROCbH.exe 2388 SmartClock.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk ysROCbH.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Ove.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Ove.exe.com -
Delays execution with timeout.exe 1 IoCs
pid Process 4060 timeout.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 864 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2388 SmartClock.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3776 Ove.exe.com 3776 Ove.exe.com -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 3680 wrote to memory of 2728 3680 66D7C25E25D943FF9972AD4E2821A586.exe 76 PID 3680 wrote to memory of 2728 3680 66D7C25E25D943FF9972AD4E2821A586.exe 76 PID 3680 wrote to memory of 2728 3680 66D7C25E25D943FF9972AD4E2821A586.exe 76 PID 3680 wrote to memory of 3992 3680 66D7C25E25D943FF9972AD4E2821A586.exe 78 PID 3680 wrote to memory of 3992 3680 66D7C25E25D943FF9972AD4E2821A586.exe 78 PID 3680 wrote to memory of 3992 3680 66D7C25E25D943FF9972AD4E2821A586.exe 78 PID 3680 wrote to memory of 188 3680 66D7C25E25D943FF9972AD4E2821A586.exe 80 PID 3680 wrote to memory of 188 3680 66D7C25E25D943FF9972AD4E2821A586.exe 80 PID 3680 wrote to memory of 188 3680 66D7C25E25D943FF9972AD4E2821A586.exe 80 PID 3680 wrote to memory of 2876 3680 66D7C25E25D943FF9972AD4E2821A586.exe 82 PID 3680 wrote to memory of 2876 3680 66D7C25E25D943FF9972AD4E2821A586.exe 82 PID 3680 wrote to memory of 2876 3680 66D7C25E25D943FF9972AD4E2821A586.exe 82 PID 3680 wrote to memory of 3616 3680 66D7C25E25D943FF9972AD4E2821A586.exe 84 PID 3680 wrote to memory of 3616 3680 66D7C25E25D943FF9972AD4E2821A586.exe 84 PID 3680 wrote to memory of 3616 3680 66D7C25E25D943FF9972AD4E2821A586.exe 84 PID 3680 wrote to memory of 1604 3680 66D7C25E25D943FF9972AD4E2821A586.exe 86 PID 3680 wrote to memory of 1604 3680 66D7C25E25D943FF9972AD4E2821A586.exe 86 PID 3680 wrote to memory of 1604 3680 66D7C25E25D943FF9972AD4E2821A586.exe 86 PID 3680 wrote to memory of 4084 3680 66D7C25E25D943FF9972AD4E2821A586.exe 88 PID 3680 wrote to memory of 4084 3680 66D7C25E25D943FF9972AD4E2821A586.exe 88 PID 3680 wrote to memory of 4084 3680 66D7C25E25D943FF9972AD4E2821A586.exe 88 PID 4084 wrote to memory of 1288 4084 cmd.exe 90 PID 4084 wrote to memory of 1288 4084 cmd.exe 90 PID 4084 wrote to memory of 1288 4084 cmd.exe 90 PID 1288 wrote to memory of 2192 1288 cmd.exe 91 PID 1288 wrote to memory of 2192 1288 cmd.exe 91 PID 1288 wrote to memory of 2192 1288 cmd.exe 91 PID 1288 wrote to memory of 2108 1288 cmd.exe 92 PID 1288 wrote to memory of 2108 1288 cmd.exe 92 PID 1288 wrote to memory of 2108 1288 cmd.exe 92 PID 1288 wrote to memory of 864 1288 cmd.exe 93 PID 1288 wrote to memory of 864 1288 cmd.exe 93 PID 1288 wrote to memory of 864 1288 cmd.exe 93 PID 2108 wrote to memory of 3776 2108 Ove.exe.com 94 PID 2108 wrote to memory of 3776 2108 Ove.exe.com 94 PID 2108 wrote to memory of 3776 2108 Ove.exe.com 94 PID 3776 wrote to memory of 3428 3776 Ove.exe.com 98 PID 3776 wrote to memory of 3428 3776 Ove.exe.com 98 PID 3776 wrote to memory of 3428 3776 Ove.exe.com 98 PID 3428 wrote to memory of 748 3428 cmd.exe 100 PID 3428 wrote to memory of 748 3428 cmd.exe 100 PID 3428 wrote to memory of 748 3428 cmd.exe 100 PID 3776 wrote to memory of 4056 3776 Ove.exe.com 101 PID 3776 wrote to memory of 4056 3776 Ove.exe.com 101 PID 3776 wrote to memory of 4056 3776 Ove.exe.com 101 PID 4056 wrote to memory of 4060 4056 cmd.exe 103 PID 4056 wrote to memory of 4060 4056 cmd.exe 103 PID 4056 wrote to memory of 4060 4056 cmd.exe 103 PID 748 wrote to memory of 2388 748 ysROCbH.exe 104 PID 748 wrote to memory of 2388 748 ysROCbH.exe 104 PID 748 wrote to memory of 2388 748 ysROCbH.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\66D7C25E25D943FF9972AD4E2821A586.exe"C:\Users\Admin\AppData\Local\Temp\66D7C25E25D943FF9972AD4E2821A586.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c IDrlwJfYJMXmiwvMLejGiwpEbzAYBNQCCBNmtKWnUyoSIhlcKugZfCLGzmNHpdbWWxXGgWHqyOLwSsWpoyhxmQjZPuuFXggDIjVhdDuOnhTBQJNeCEmtrebuoXQoQeeRmiz2⤵PID:2728
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cJSEYmWkWKpyarezPlAGPOtzNYXvleeIdiGTLUuDuklbOKPNZJefHMQGEmRZBmqUIAPkvpHUtXADEHEeplvBZMwDdZgjeuwGk2⤵PID:3992
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c PhVEdQeikKjheXUPQsrmUVmkUvUcSXVTagSsuFUGnRBssrXsshdK2⤵PID:188
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c LcTNKJTWHfhOaVNyDIlvbqezoURnCrEGldGTYDvVqJRCgCYoljOEygyLamFQRczDKHEegTuZkfvNoAyFVJgfgZBW2⤵PID:2876
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c UAnYGtFfgRHYVTsuOzQRaCSxZUiirgLuHRzaHwF2⤵PID:3616
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c QbUJnHqQWpAGKtSaItYMWnjZuBdtmYnNNFqVIpV2⤵PID:1604
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rhCXAMlbIpgvnaQrwtQfFzGEIidtAfAdlUEGulyjCLneKrEtxoszjcVJHXfavyXzJYkEOlWQYEMUVDUECkJa & irPYUYpUNPbOyzMRqdlkAcHIwOrrLQkcEcBUvFUkNWlPfyPpoMBVmuvMcuXuUuoWDwpKSRxxvYnElSzVYUUYgdVnYPndINdHNgkhVyddaimBISBDNwiqklIjuLLrztMIHRQWHyqTDEGiRxP & hVCGGdvDGYipzhXhxQTRwFVHwhvG & AcMWEPbBywscjdIYQAfGzMqAYyHZVFzTPqyDxhObmLfOCcOfhJkNiZlOxjXmonGAIbFjlyDCLRiHbjXCdsMjzGMPQ & oodffqtPytQBtiyIwfSCsogxoQMxueLQvUWcjcCuCIuSMOjEuLEvWhZ & TVungKIrzZyl & KvFMLZJwvIzEihcngToUVBsfrRSZrmNJwzvfYKk & dYbjNUivhEtyWdfotdJTiJYXVKCNQyAEIUEWttCpKcLnxHNL & glHqsuGqmseazGitmbwLat & OApLYmCgWQJCVSDsNYWENmQsPExUlLqMllSAicIAXruCKrjkWyhMcmjfJSWzyHrlPWaKZepadcHKahGMsoYtnhdKYCRfngcfZVMNKCkTVVvqSBXckleWJZMBGILbkTTeqsKbBSwPWypCRdSvFctgk & FqokieQOHwwzqARmUaphqDPpJfQfRQPFQBLKgfLYYobiBbdsFyALyYnelZBRjBXRjvDnOukEHlgS & IIjZnJLftmRrJAgOTMblGVtUR & mUWtVKGWBdfSORjCoWLctGWQObRHmNDaiUlRzqEivNYYnqYFYtNiovnSXyfbSYvONXKTHcpoaEYdHYsNmjJxqcpLv & ThKugndplBdyXDVFPDnolYNCYGfeOsNYbfBVbjfAZnNQvxgumcGGjhuVA & oIogcTOsHIwqiDgYoMlWyEapCaKiLppG & frGsLeUetMGtmhrsgyzKDeDdYMeoHFnncFSmHGbKdUqSMyryHPbrPWQjAdaYZLxnh & JTcDKIIJzJeLDTIXBRocJmOFZdhnL & mBEEcpJryOxuCilOMndwlDfSbltQEzxlXPpAiYbngbMzqCWHckDOoJxWkMikyTmLxloNYKGNqRNNQWRUhbxzPFwgcjgx & jzxYwZPxpILEPOdVGufUjYInyVPpTaMcjWObaOPWeArOJPqRKaOyYmFhLWSypGARWfsTZTDSdaSLVTOdVXnBDGbMdBMcWKMcZkSxbuSRPWPFHTsRiCpjoZgfRFDbuiW & FvMKwxSPyGLHRRybpUgzAAhqXCCRDxLHqoZliHQNJxuChGnqAuhkTCuypLMmRqkLVrHISUfBtAJyxLMsrCsbumObeUqcVdVIo & GpYQiFQMiaSqKnYccfJOEcfpGXUTGNFwWZtDahxMGxsvEwlCbmUGZxQkUOplLWyzMR & KxcroUXiprSFFNaviSZwC & C:\Windows\system32\cmd < Naufrago.vssm2⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd3⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^MPJomTHJarWYKrSxnHIhGEIlXeqEtUnnpLOyyJXoCUxrBcBNOGmEhseoimkvSrFbFbPYfMgPJmLMpEIBBjPbcUkSJFYFbBdngXbrGCnesKUNGdZCQKVFhieLkWfJNIs$" Vedi.vssm4⤵PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.comOve.exe.com U4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.com U5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\ysROCbH.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\ysROCbH.exe"C:\Users\Admin\AppData\Local\Temp\ysROCbH.exe"7⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:2388
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\KNVglUKfWRL & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.com"6⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\timeout.exetimeout 37⤵
- Delays execution with timeout.exe
PID:4060
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
PID:864
-
-
-