Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    24-06-2021 02:02

General

  • Target

    d091285362e6cfcf60690c8a4dcd695e.exe

  • Size

    97KB

  • MD5

    d091285362e6cfcf60690c8a4dcd695e

  • SHA1

    0ad0bcc57498a5c2d1251f6fef81806be70aec04

  • SHA256

    a8f36e203ba22b243837f95a371fbad43ef4162e2cf6f01ab78714fed88e7bb3

  • SHA512

    4844a9844f302fa81d17ae1229574905eec70203a9708cc36434f75a2791c7905c76824da89e2c10e55aef72207341340fddc500b80575fb2fe1873308e22400

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d091285362e6cfcf60690c8a4dcd695e.exe
    "C:\Users\Admin\AppData\Local\Temp\d091285362e6cfcf60690c8a4dcd695e.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:564
    • C:\Users\Admin\AppData\Local\Temp\kd4ka2tc.5oq.exe
      "C:\Users\Admin\AppData\Local\Temp\kd4ka2tc.5oq.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3736
      • C:\ProgramData\Decoder.exe
        "C:\ProgramData\Decoder.exe"
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3580
        • C:\Windows\system32\timeout.exe
          timeout 4
          4⤵
          • Delays execution with timeout.exe
          PID:3140
    • C:\Users\Admin\AppData\Local\Temp\a2w304xa.nbb.exe
      "C:\Users\Admin\AppData\Local\Temp\a2w304xa.nbb.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3236
      • C:\Users\Admin\AppData\Roaming\Microsoft.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:704
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft.exe" "Microsoft.exe" ENABLE
          4⤵
            PID:3176

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Decoder.exe

      MD5

      c29c0d495ed13e703f433d53bdffdab8

      SHA1

      74ed36e6b6027b61abcfe2956670ffd9de7fd71a

      SHA256

      20309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b

      SHA512

      fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426

    • C:\ProgramData\Decoder.exe

      MD5

      c29c0d495ed13e703f433d53bdffdab8

      SHA1

      74ed36e6b6027b61abcfe2956670ffd9de7fd71a

      SHA256

      20309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b

      SHA512

      fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426

    • C:\Users\Admin\AppData\Local\Temp\.cmd

      MD5

      73712247036b6a24d16502c57a3e5679

      SHA1

      65ca9edadb0773fc34db7dfefe9e6416f1ac17fa

      SHA256

      8bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0

      SHA512

      548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de

    • C:\Users\Admin\AppData\Local\Temp\a2w304xa.nbb.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • C:\Users\Admin\AppData\Local\Temp\a2w304xa.nbb.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • C:\Users\Admin\AppData\Local\Temp\kd4ka2tc.5oq.exe

      MD5

      eb2efc889c96765d41bcac7ae5586f93

      SHA1

      f6129e5533d751f33bea71d2f114b2e217ecbb5c

      SHA256

      b12603344325e60166c40764c52866e4cdc556f0176017f2cb71b5e7f0f591f0

      SHA512

      5003c8d36343fe8c2761f6c73d73b9c2f99da59d9b7d80dd29dc7eb754e52ef25285b65b50119fa09d02f8ab354d8d0fd7dd59bb09f372b0347d0c2ef87be3f9

    • C:\Users\Admin\AppData\Local\Temp\kd4ka2tc.5oq.exe

      MD5

      eb2efc889c96765d41bcac7ae5586f93

      SHA1

      f6129e5533d751f33bea71d2f114b2e217ecbb5c

      SHA256

      b12603344325e60166c40764c52866e4cdc556f0176017f2cb71b5e7f0f591f0

      SHA512

      5003c8d36343fe8c2761f6c73d73b9c2f99da59d9b7d80dd29dc7eb754e52ef25285b65b50119fa09d02f8ab354d8d0fd7dd59bb09f372b0347d0c2ef87be3f9

    • C:\Users\Admin\AppData\Roaming\Microsoft.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • C:\Users\Admin\AppData\Roaming\Microsoft.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • memory/564-116-0x00000000055B0000-0x00000000055B1000-memory.dmp

      Filesize

      4KB

    • memory/564-114-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

      Filesize

      4KB

    • memory/704-138-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

      Filesize

      4KB

    • memory/704-128-0x0000000000000000-mapping.dmp

    • memory/2976-142-0x0000000004B80000-0x0000000004B81000-memory.dmp

      Filesize

      4KB

    • memory/2976-143-0x0000000004A20000-0x0000000004AB4000-memory.dmp

      Filesize

      592KB

    • memory/2976-131-0x0000000000000000-mapping.dmp

    • memory/2976-146-0x0000000006FC0000-0x0000000006FC1000-memory.dmp

      Filesize

      4KB

    • memory/2976-145-0x0000000005190000-0x0000000005191000-memory.dmp

      Filesize

      4KB

    • memory/2976-147-0x00000000054A0000-0x0000000005510000-memory.dmp

      Filesize

      448KB

    • memory/2976-137-0x0000000004AE0000-0x0000000004B76000-memory.dmp

      Filesize

      600KB

    • memory/2976-144-0x0000000004AD4000-0x0000000004AD6000-memory.dmp

      Filesize

      8KB

    • memory/2976-139-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

      Filesize

      4KB

    • memory/2976-140-0x0000000004AD2000-0x0000000004AD3000-memory.dmp

      Filesize

      4KB

    • memory/2976-141-0x0000000004AD3000-0x0000000004AD4000-memory.dmp

      Filesize

      4KB

    • memory/3140-136-0x0000000000000000-mapping.dmp

    • memory/3176-148-0x0000000000000000-mapping.dmp

    • memory/3236-121-0x0000000000000000-mapping.dmp

    • memory/3236-125-0x0000000002520000-0x0000000002521000-memory.dmp

      Filesize

      4KB

    • memory/3580-134-0x0000000000000000-mapping.dmp

    • memory/3736-127-0x000000001BC50000-0x000000001BC52000-memory.dmp

      Filesize

      8KB

    • memory/3736-126-0x0000000002D20000-0x0000000002D91000-memory.dmp

      Filesize

      452KB

    • memory/3736-120-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

      Filesize

      4KB

    • memory/3736-117-0x0000000000000000-mapping.dmp