Resubmissions

08-07-2021 12:18

210708-8z6d5h8z2n 10

06-07-2021 17:53

210706-g6we6sa7sa 10

19-06-2021 18:17

210619-vr8bj2dzfn 10

17-06-2021 21:39

210617-a9cvlnmrbx 10

11-06-2021 17:26

210611-wvab1yw2tj 10

08-06-2021 06:47

210608-qrbpch3y46 10

08-06-2021 06:47

210608-64tndgm1ln 10

05-06-2021 18:40

210605-cd6qpr55sx 10

04-06-2021 11:56

210604-5c416rs3ns 10

04-06-2021 08:52

210604-jy9885jen2 10

Analysis

  • max time kernel
    3s
  • max time network
    10s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    26-05-2021 11:51

General

  • Target

    keygen-step-4.exe

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
    "C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      PID:2732
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
        3⤵
          PID:2648
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"
        2⤵
          PID:200
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        1⤵
          PID:1580

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\install.dat

          MD5

          f3f4176abe57c776cfc0a71be3c3ee9e

          SHA1

          9179832f5da966a6ca83264bf970823acd2f8d28

          SHA256

          f31d082ec54e53be57d9a9daa9d3bf2b6a9f83d2b8660e9efb2917a75e010422

          SHA512

          181762ca55e235a4b22160f003a795d86e05e8181f21df53c3a0ca7ee32e897d476d56ee3367cb1c6721ce922c345a71f3e5d4d5df203f81388db7204acafe7c

        • C:\Program Files\install.dll

          MD5

          fe60ddbeab6e50c4f490ddf56b52057c

          SHA1

          6a71fdf73761a1192fd9c6961f66754a63d6db17

          SHA256

          9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

          SHA512

          0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe

          MD5

          3b1b318df4d314a35dce9e8fd89e5121

          SHA1

          55b0f8d56212a74bda0fc5f8cc0632ef52a4bc71

          SHA256

          4df9e7fcd10900ae5def897377f54856b0ddad1798fa22614eba56096940885b

          SHA512

          f04faca320d344378dd31bf05556fb3ac02873e46e2140d5858162e739f5c25bc9b32d619587c84c36b768b9193ea5292d63f62bb0b8458b35d65959b52df6b4

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe

          MD5

          3b1b318df4d314a35dce9e8fd89e5121

          SHA1

          55b0f8d56212a74bda0fc5f8cc0632ef52a4bc71

          SHA256

          4df9e7fcd10900ae5def897377f54856b0ddad1798fa22614eba56096940885b

          SHA512

          f04faca320d344378dd31bf05556fb3ac02873e46e2140d5858162e739f5c25bc9b32d619587c84c36b768b9193ea5292d63f62bb0b8458b35d65959b52df6b4

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe

          MD5

          e72eb3a565d7b5b83c7ff6fad519c6c9

          SHA1

          1a2668a26b01828eec1415aa614743abb0a4fb70

          SHA256

          8ff1e74643983f7ca9bca70f1bea562e805a86421defde1bd57fc0da3722f599

          SHA512

          71ae4db9c307c068f31a4e6471d950d1112d89d5661a4960dffbf6a7343cc313f98cfc35c5a10d38aae68be4b0a3f6a702fd5c28d938ca00094b26d0bcf03da3

        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe

          MD5

          e72eb3a565d7b5b83c7ff6fad519c6c9

          SHA1

          1a2668a26b01828eec1415aa614743abb0a4fb70

          SHA256

          8ff1e74643983f7ca9bca70f1bea562e805a86421defde1bd57fc0da3722f599

          SHA512

          71ae4db9c307c068f31a4e6471d950d1112d89d5661a4960dffbf6a7343cc313f98cfc35c5a10d38aae68be4b0a3f6a702fd5c28d938ca00094b26d0bcf03da3

        • \Program Files\install.dll

          MD5

          fe60ddbeab6e50c4f490ddf56b52057c

          SHA1

          6a71fdf73761a1192fd9c6961f66754a63d6db17

          SHA256

          9fcfa73600ff1b588015ffa20779cec6714e48ee6ae15db8766f7ffd5ee3031d

          SHA512

          0113b47ba1a33a2f597a26c9b66435483373cde4edb183e0e92abef8ed003743f426ba5ffe25a5807c030cc14d8a95d73aa6af95a85f44a86dd40264ecb96536

        • memory/200-126-0x0000000000B10000-0x0000000000B11000-memory.dmp

          Filesize

          4KB

        • memory/200-140-0x0000000001030000-0x000000000104C000-memory.dmp

          Filesize

          112KB

        • memory/200-146-0x0000000001050000-0x0000000001051000-memory.dmp

          Filesize

          4KB

        • memory/200-120-0x0000000000000000-mapping.dmp

        • memory/200-132-0x0000000001020000-0x0000000001021000-memory.dmp

          Filesize

          4KB

        • memory/1580-144-0x0000018B4D8D0000-0x0000018B4D940000-memory.dmp

          Filesize

          448KB

        • memory/1580-135-0x00007FF774F54060-mapping.dmp

        • memory/2580-143-0x000001B713E00000-0x000001B713E70000-memory.dmp

          Filesize

          448KB

        • memory/2648-129-0x000000000491B000-0x0000000004A1C000-memory.dmp

          Filesize

          1.0MB

        • memory/2648-131-0x00000000030E0000-0x000000000313C000-memory.dmp

          Filesize

          368KB

        • memory/2648-119-0x0000000000000000-mapping.dmp

        • memory/2732-116-0x0000000000000000-mapping.dmp

        • memory/3388-134-0x0000012BB3420000-0x0000012BB346B000-memory.dmp

          Filesize

          300KB

        • memory/3388-133-0x0000012BB36B0000-0x0000012BB3720000-memory.dmp

          Filesize

          448KB