Analysis
- max time kernel
149s - max time network
149s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/06/2021, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
E9A21ECBB9DD174FAB29F35BC830427F.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target E9A21ECBB9DD174FAB29F35BC830427F.exe
- Size 669KB
- Sample210627-sdl6t1gmpa
- SHA256 c54228f797eb663e6a223ecf20f225f91bc2e1dfbea5ac84687ff87513a0dad5
- MD5 e9a21ecbb9dd174fab29f35bc830427f
- SHA1 51c13a1ce196ac6626ab644fb6b900ec3db913e5
- SHA512 57174fd149834227c3779fbc97819eee9d878f76140e1f1e5ba8f2c0c0551b71b1e30372a88419e49fbfc7d4772171a0e0f6ba38d42899ffc187c4f3ce2ff96f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
flow pid Process 23 4052 cmd.exe 25 4052 cmd.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 1992 RldlZTNVjC.exe - Loads dropped DLL 5 IoCs
pid Process 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 640 E9A21ECBB9DD174FAB29F35BC830427F.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 eth0.me - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\RldlZTNVjC.job cmd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Delays execution with timeout.exe 1 IoCs
pid Process 1312 timeout.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 1992 RldlZTNVjC.exe 3720 notepad.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe 4052 cmd.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3720 notepad.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4052 cmd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 640 wrote to memory of 1992 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 76 PID 640 wrote to memory of 1992 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 76 PID 640 wrote to memory of 1992 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 76 PID 640 wrote to memory of 3712 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 77 PID 640 wrote to memory of 3712 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 77 PID 640 wrote to memory of 3712 640 E9A21ECBB9DD174FAB29F35BC830427F.exe 77 PID 3712 wrote to memory of 1312 3712 cmd.exe 79 PID 3712 wrote to memory of 1312 3712 cmd.exe 79 PID 3712 wrote to memory of 1312 3712 cmd.exe 79 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81 PID 1992 wrote to memory of 3720 1992 RldlZTNVjC.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\E9A21ECBB9DD174FAB29F35BC830427F.exe"C:\Users\Admin\AppData\Local\Temp\E9A21ECBB9DD174FAB29F35BC830427F.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\RldlZTNVjC.exe"C:\Users\Admin\AppData\Local\Temp\RldlZTNVjC.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\E9A21ECBB9DD174FAB29F35BC830427F.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1312
-
-