Analysis
-
max time kernel
132s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-05-2021 04:48
Static task
static1
Behavioral task
behavioral1
Sample
18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe
-
Size
135KB
-
MD5
48fba897d161a3d734c6aff3119f952a
-
SHA1
8dd00aec4276f2aaf6de1ba98cc9ffdf209ce420
-
SHA256
18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891
-
SHA512
0c072a4f24622f6c1a72722cadfc88b2e4c3417b002889c95b0dc7535681e9e35c5f53ed5c68337e807a0babd6bf488192a92cda2400cc7e5dd7a5919aa257a7
Malware Config
Signatures
-
Drops file in System32 directory 5 IoCs
Processes:
relcomment.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat relcomment.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 relcomment.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE relcomment.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies relcomment.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 relcomment.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
relcomment.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" relcomment.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix relcomment.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" relcomment.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
relcomment.exepid process 4076 relcomment.exe 4076 relcomment.exe 4076 relcomment.exe 4076 relcomment.exe 4076 relcomment.exe 4076 relcomment.exe 4076 relcomment.exe 4076 relcomment.exe 4076 relcomment.exe 4076 relcomment.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exepid process 2420 18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exerelcomment.exedescription pid process target process PID 2204 wrote to memory of 2420 2204 18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe 18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe PID 2204 wrote to memory of 2420 2204 18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe 18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe PID 2204 wrote to memory of 2420 2204 18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe 18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe PID 2144 wrote to memory of 4076 2144 relcomment.exe relcomment.exe PID 2144 wrote to memory of 4076 2144 relcomment.exe relcomment.exe PID 2144 wrote to memory of 4076 2144 relcomment.exe relcomment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe"C:\Users\Admin\AppData\Local\Temp\18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\18c788edd309a5c15d9163cf016cd9651bf2db15622dcf3c21286b6b7f22f891.exe--cded26f72⤵
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\relcomment.exe"C:\Windows\SysWOW64\relcomment.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\relcomment.exe--a981fc782⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2144-119-0x0000000000430000-0x000000000057A000-memory.dmpFilesize
1.3MB
-
memory/2144-121-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2204-114-0x0000000000550000-0x0000000000561000-memory.dmpFilesize
68KB
-
memory/2204-116-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2420-115-0x0000000000000000-mapping.dmp
-
memory/2420-117-0x0000000000550000-0x000000000069A000-memory.dmpFilesize
1.3MB
-
memory/2420-118-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4076-120-0x0000000000000000-mapping.dmp
-
memory/4076-122-0x0000000000430000-0x00000000004DE000-memory.dmpFilesize
696KB
-
memory/4076-123-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB