Analysis
- max time kernel
68s - max time network
91s - platform
windows7_x64 - resource
win7v20210408 - submitted
24/05/2021, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
751798eb_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
751798eb_by_Libranalysis.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 751798eb_by_Libranalysis.exe
- Size 1.5MB
- Sample210524-egcedxc8qs
- SHA256 703cb19c4f58a9043fc687cc2a851640d6f79ff7e8afafdc41dfcb3c896df017
- MD5 751798eb2b9f14d827c94d49e2764098
- SHA1 e7f758090c7af782e5b6e64d2db16fd88f41e933
- SHA512 08f450775440e546fe7ca4cee6d09fa37e3b0910c7f743c7bb39e3eec8e7f07f5e7ba20236c7509d264646adfe8d4738ba2bcffa7f8d43605cc016bf7b5bffc1
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 1456 vpn.exe 1224 4.exe 1028 Finita.exe.com 1776 Finita.exe.com 928 SmartClock.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 4.exe - Loads dropped DLL 17 IoCs
pid Process 1944 751798eb_by_Libranalysis.exe 1944 751798eb_by_Libranalysis.exe 1944 751798eb_by_Libranalysis.exe 1944 751798eb_by_Libranalysis.exe 1456 vpn.exe 1456 vpn.exe 1224 4.exe 1224 4.exe 1224 4.exe 1816 cmd.exe 1028 Finita.exe.com 1224 4.exe 1224 4.exe 1224 4.exe 928 SmartClock.exe 928 SmartClock.exe 928 SmartClock.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1776 set thread context of 1916 1776 Finita.exe.com 39 - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\foler\olader\acppage.dll 751798eb_by_Libranalysis.exe File created C:\Program Files (x86)\foler\olader\adprovider.dll 751798eb_by_Libranalysis.exe File created C:\Program Files (x86)\foler\olader\acledit.dll 751798eb_by_Libranalysis.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 attrib.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString attrib.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1672 PING.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 928 SmartClock.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1456 vpn.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1456 1944 751798eb_by_Libranalysis.exe 26 PID 1944 wrote to memory of 1456 1944 751798eb_by_Libranalysis.exe 26 PID 1944 wrote to memory of 1456 1944 751798eb_by_Libranalysis.exe 26 PID 1944 wrote to memory of 1456 1944 751798eb_by_Libranalysis.exe 26 PID 1944 wrote to memory of 1456 1944 751798eb_by_Libranalysis.exe 26 PID 1944 wrote to memory of 1456 1944 751798eb_by_Libranalysis.exe 26 PID 1944 wrote to memory of 1456 1944 751798eb_by_Libranalysis.exe 26 PID 1944 wrote to memory of 1224 1944 751798eb_by_Libranalysis.exe 27 PID 1944 wrote to memory of 1224 1944 751798eb_by_Libranalysis.exe 27 PID 1944 wrote to memory of 1224 1944 751798eb_by_Libranalysis.exe 27 PID 1944 wrote to memory of 1224 1944 751798eb_by_Libranalysis.exe 27 PID 1944 wrote to memory of 1224 1944 751798eb_by_Libranalysis.exe 27 PID 1944 wrote to memory of 1224 1944 751798eb_by_Libranalysis.exe 27 PID 1944 wrote to memory of 1224 1944 751798eb_by_Libranalysis.exe 27 PID 1456 wrote to memory of 1812 1456 vpn.exe 28 PID 1456 wrote to memory of 1812 1456 vpn.exe 28 PID 1456 wrote to memory of 1812 1456 vpn.exe 28 PID 1456 wrote to memory of 1812 1456 vpn.exe 28 PID 1456 wrote to memory of 1812 1456 vpn.exe 28 PID 1456 wrote to memory of 1812 1456 vpn.exe 28 PID 1456 wrote to memory of 1812 1456 vpn.exe 28 PID 1812 wrote to memory of 1816 1812 cmd.exe 30 PID 1812 wrote to memory of 1816 1812 cmd.exe 30 PID 1812 wrote to memory of 1816 1812 cmd.exe 30 PID 1812 wrote to memory of 1816 1812 cmd.exe 30 PID 1812 wrote to memory of 1816 1812 cmd.exe 30 PID 1812 wrote to memory of 1816 1812 cmd.exe 30 PID 1812 wrote to memory of 1816 1812 cmd.exe 30 PID 1816 wrote to memory of 1756 1816 cmd.exe 31 PID 1816 wrote to memory of 1756 1816 cmd.exe 31 PID 1816 wrote to memory of 1756 1816 cmd.exe 31 PID 1816 wrote to memory of 1756 1816 cmd.exe 31 PID 1816 wrote to memory of 1756 1816 cmd.exe 31 PID 1816 wrote to memory of 1756 1816 cmd.exe 31 PID 1816 wrote to memory of 1756 1816 cmd.exe 31 PID 1816 wrote to memory of 1028 1816 cmd.exe 32 PID 1816 wrote to memory of 1028 1816 cmd.exe 32 PID 1816 wrote to memory of 1028 1816 cmd.exe 32 PID 1816 wrote to memory of 1028 1816 cmd.exe 32 PID 1816 wrote to memory of 1028 1816 cmd.exe 32 PID 1816 wrote to memory of 1028 1816 cmd.exe 32 PID 1816 wrote to memory of 1028 1816 cmd.exe 32 PID 1816 wrote to memory of 1672 1816 cmd.exe 33 PID 1816 wrote to memory of 1672 1816 cmd.exe 33 PID 1816 wrote to memory of 1672 1816 cmd.exe 33 PID 1816 wrote to memory of 1672 1816 cmd.exe 33 PID 1816 wrote to memory of 1672 1816 cmd.exe 33 PID 1816 wrote to memory of 1672 1816 cmd.exe 33 PID 1816 wrote to memory of 1672 1816 cmd.exe 33 PID 1028 wrote to memory of 1776 1028 Finita.exe.com 34 PID 1028 wrote to memory of 1776 1028 Finita.exe.com 34 PID 1028 wrote to memory of 1776 1028 Finita.exe.com 34 PID 1028 wrote to memory of 1776 1028 Finita.exe.com 34 PID 1028 wrote to memory of 1776 1028 Finita.exe.com 34 PID 1028 wrote to memory of 1776 1028 Finita.exe.com 34 PID 1028 wrote to memory of 1776 1028 Finita.exe.com 34 PID 1224 wrote to memory of 928 1224 4.exe 38 PID 1224 wrote to memory of 928 1224 4.exe 38 PID 1224 wrote to memory of 928 1224 4.exe 38 PID 1224 wrote to memory of 928 1224 4.exe 38 PID 1224 wrote to memory of 928 1224 4.exe 38 PID 1224 wrote to memory of 928 1224 4.exe 38 PID 1224 wrote to memory of 928 1224 4.exe 38 PID 1776 wrote to memory of 1916 1776 Finita.exe.com 39 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1916 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\751798eb_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\751798eb_by_Libranalysis.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Mani.tiff3⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^evPBaEfWQqyNKZLtKkIKaOhysWAewfstsPVxTRBcMnTIddqdSDRELSGhpKpvtjVBJqvVrskTKhYTVEPwWppbbMznoHloItdmDsYfTtjBaYUnUMsEUimVrbrWHYMvuelFWndEGmiRXHtmSVDvfFhA$" Tramonto.tiff5⤵PID:1756
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Finita.exe.comFinita.exe.com c5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Finita.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Finita.exe.com c6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\attrib.exeC:\Windows\SysWOW64\attrib.exe7⤵
- Checks processor information in registry
- Views/modifies file attributes
PID:1916
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 305⤵
- Runs ping.exe
PID:1672
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:928
-
-