Analysis
-
max time kernel
127s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14/05/2021, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
66D7C25E25D943FF9972AD4E2821A586.exe
Resource
win7v20210410
General
-
Target
66D7C25E25D943FF9972AD4E2821A586.exe
-
Size
1.9MB
-
MD5
66d7c25e25d943ff9972ad4e2821a586
-
SHA1
1c2f71afa6f6e13dd5939f4cad875aad33902627
-
SHA256
41f2e8b68fe406f818f0ab48067d967cc0a3430a9ddb97a191b3fca163b756ab
-
SHA512
18d40773115c4bf9a80c1b91c04b0a58eeb69f8c9b25da68dcfcb92e3d532ba09d2aa6a278d6e0891e19e3e572ba1c77efe422189bd9b752ce770609904ac76f
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1080 Ove.exe.com 2060 Ove.exe.com -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Ove.exe.com Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Ove.exe.com -
Delays execution with timeout.exe 1 IoCs
pid Process 504 timeout.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3364 PING.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2060 Ove.exe.com 2060 Ove.exe.com -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 856 wrote to memory of 744 856 66D7C25E25D943FF9972AD4E2821A586.exe 74 PID 856 wrote to memory of 744 856 66D7C25E25D943FF9972AD4E2821A586.exe 74 PID 856 wrote to memory of 744 856 66D7C25E25D943FF9972AD4E2821A586.exe 74 PID 856 wrote to memory of 4012 856 66D7C25E25D943FF9972AD4E2821A586.exe 76 PID 856 wrote to memory of 4012 856 66D7C25E25D943FF9972AD4E2821A586.exe 76 PID 856 wrote to memory of 4012 856 66D7C25E25D943FF9972AD4E2821A586.exe 76 PID 856 wrote to memory of 644 856 66D7C25E25D943FF9972AD4E2821A586.exe 78 PID 856 wrote to memory of 644 856 66D7C25E25D943FF9972AD4E2821A586.exe 78 PID 856 wrote to memory of 644 856 66D7C25E25D943FF9972AD4E2821A586.exe 78 PID 856 wrote to memory of 3116 856 66D7C25E25D943FF9972AD4E2821A586.exe 80 PID 856 wrote to memory of 3116 856 66D7C25E25D943FF9972AD4E2821A586.exe 80 PID 856 wrote to memory of 3116 856 66D7C25E25D943FF9972AD4E2821A586.exe 80 PID 856 wrote to memory of 3356 856 66D7C25E25D943FF9972AD4E2821A586.exe 82 PID 856 wrote to memory of 3356 856 66D7C25E25D943FF9972AD4E2821A586.exe 82 PID 856 wrote to memory of 3356 856 66D7C25E25D943FF9972AD4E2821A586.exe 82 PID 856 wrote to memory of 196 856 66D7C25E25D943FF9972AD4E2821A586.exe 84 PID 856 wrote to memory of 196 856 66D7C25E25D943FF9972AD4E2821A586.exe 84 PID 856 wrote to memory of 196 856 66D7C25E25D943FF9972AD4E2821A586.exe 84 PID 856 wrote to memory of 1448 856 66D7C25E25D943FF9972AD4E2821A586.exe 86 PID 856 wrote to memory of 1448 856 66D7C25E25D943FF9972AD4E2821A586.exe 86 PID 856 wrote to memory of 1448 856 66D7C25E25D943FF9972AD4E2821A586.exe 86 PID 1448 wrote to memory of 3888 1448 cmd.exe 88 PID 1448 wrote to memory of 3888 1448 cmd.exe 88 PID 1448 wrote to memory of 3888 1448 cmd.exe 88 PID 3888 wrote to memory of 1736 3888 cmd.exe 89 PID 3888 wrote to memory of 1736 3888 cmd.exe 89 PID 3888 wrote to memory of 1736 3888 cmd.exe 89 PID 3888 wrote to memory of 1080 3888 cmd.exe 90 PID 3888 wrote to memory of 1080 3888 cmd.exe 90 PID 3888 wrote to memory of 1080 3888 cmd.exe 90 PID 3888 wrote to memory of 3364 3888 cmd.exe 91 PID 3888 wrote to memory of 3364 3888 cmd.exe 91 PID 3888 wrote to memory of 3364 3888 cmd.exe 91 PID 1080 wrote to memory of 2060 1080 Ove.exe.com 92 PID 1080 wrote to memory of 2060 1080 Ove.exe.com 92 PID 1080 wrote to memory of 2060 1080 Ove.exe.com 92 PID 2060 wrote to memory of 652 2060 Ove.exe.com 96 PID 2060 wrote to memory of 652 2060 Ove.exe.com 96 PID 2060 wrote to memory of 652 2060 Ove.exe.com 96 PID 652 wrote to memory of 504 652 cmd.exe 98 PID 652 wrote to memory of 504 652 cmd.exe 98 PID 652 wrote to memory of 504 652 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\66D7C25E25D943FF9972AD4E2821A586.exe"C:\Users\Admin\AppData\Local\Temp\66D7C25E25D943FF9972AD4E2821A586.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c IDrlwJfYJMXmiwvMLejGiwpEbzAYBNQCCBNmtKWnUyoSIhlcKugZfCLGzmNHpdbWWxXGgWHqyOLwSsWpoyhxmQjZPuuFXggDIjVhdDuOnhTBQJNeCEmtrebuoXQoQeeRmiz2⤵PID:744
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cJSEYmWkWKpyarezPlAGPOtzNYXvleeIdiGTLUuDuklbOKPNZJefHMQGEmRZBmqUIAPkvpHUtXADEHEeplvBZMwDdZgjeuwGk2⤵PID:4012
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c PhVEdQeikKjheXUPQsrmUVmkUvUcSXVTagSsuFUGnRBssrXsshdK2⤵PID:644
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c LcTNKJTWHfhOaVNyDIlvbqezoURnCrEGldGTYDvVqJRCgCYoljOEygyLamFQRczDKHEegTuZkfvNoAyFVJgfgZBW2⤵PID:3116
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c UAnYGtFfgRHYVTsuOzQRaCSxZUiirgLuHRzaHwF2⤵PID:3356
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c QbUJnHqQWpAGKtSaItYMWnjZuBdtmYnNNFqVIpV2⤵PID:196
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rhCXAMlbIpgvnaQrwtQfFzGEIidtAfAdlUEGulyjCLneKrEtxoszjcVJHXfavyXzJYkEOlWQYEMUVDUECkJa & irPYUYpUNPbOyzMRqdlkAcHIwOrrLQkcEcBUvFUkNWlPfyPpoMBVmuvMcuXuUuoWDwpKSRxxvYnElSzVYUUYgdVnYPndINdHNgkhVyddaimBISBDNwiqklIjuLLrztMIHRQWHyqTDEGiRxP & hVCGGdvDGYipzhXhxQTRwFVHwhvG & AcMWEPbBywscjdIYQAfGzMqAYyHZVFzTPqyDxhObmLfOCcOfhJkNiZlOxjXmonGAIbFjlyDCLRiHbjXCdsMjzGMPQ & oodffqtPytQBtiyIwfSCsogxoQMxueLQvUWcjcCuCIuSMOjEuLEvWhZ & TVungKIrzZyl & KvFMLZJwvIzEihcngToUVBsfrRSZrmNJwzvfYKk & dYbjNUivhEtyWdfotdJTiJYXVKCNQyAEIUEWttCpKcLnxHNL & glHqsuGqmseazGitmbwLat & OApLYmCgWQJCVSDsNYWENmQsPExUlLqMllSAicIAXruCKrjkWyhMcmjfJSWzyHrlPWaKZepadcHKahGMsoYtnhdKYCRfngcfZVMNKCkTVVvqSBXckleWJZMBGILbkTTeqsKbBSwPWypCRdSvFctgk & FqokieQOHwwzqARmUaphqDPpJfQfRQPFQBLKgfLYYobiBbdsFyALyYnelZBRjBXRjvDnOukEHlgS & IIjZnJLftmRrJAgOTMblGVtUR & mUWtVKGWBdfSORjCoWLctGWQObRHmNDaiUlRzqEivNYYnqYFYtNiovnSXyfbSYvONXKTHcpoaEYdHYsNmjJxqcpLv & ThKugndplBdyXDVFPDnolYNCYGfeOsNYbfBVbjfAZnNQvxgumcGGjhuVA & oIogcTOsHIwqiDgYoMlWyEapCaKiLppG & frGsLeUetMGtmhrsgyzKDeDdYMeoHFnncFSmHGbKdUqSMyryHPbrPWQjAdaYZLxnh & JTcDKIIJzJeLDTIXBRocJmOFZdhnL & mBEEcpJryOxuCilOMndwlDfSbltQEzxlXPpAiYbngbMzqCWHckDOoJxWkMikyTmLxloNYKGNqRNNQWRUhbxzPFwgcjgx & jzxYwZPxpILEPOdVGufUjYInyVPpTaMcjWObaOPWeArOJPqRKaOyYmFhLWSypGARWfsTZTDSdaSLVTOdVXnBDGbMdBMcWKMcZkSxbuSRPWPFHTsRiCpjoZgfRFDbuiW & FvMKwxSPyGLHRRybpUgzAAhqXCCRDxLHqoZliHQNJxuChGnqAuhkTCuypLMmRqkLVrHISUfBtAJyxLMsrCsbumObeUqcVdVIo & GpYQiFQMiaSqKnYccfJOEcfpGXUTGNFwWZtDahxMGxsvEwlCbmUGZxQkUOplLWyzMR & KxcroUXiprSFFNaviSZwC & C:\Windows\system32\cmd < Naufrago.vssm2⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd3⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^MPJomTHJarWYKrSxnHIhGEIlXeqEtUnnpLOyyJXoCUxrBcBNOGmEhseoimkvSrFbFbPYfMgPJmLMpEIBBjPbcUkSJFYFbBdngXbrGCnesKUNGdZCQKVFhieLkWfJNIs$" Vedi.vssm4⤵PID:1736
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.comOve.exe.com U4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.com U5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\HVoVrPam & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ove.exe.com"6⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\timeout.exetimeout 37⤵
- Delays execution with timeout.exe
PID:504
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
PID:3364
-
-
-