Overview
overview
10Static
static
106c5db6dce1...3e.exe
windows7_x64
106c5db6dce1...3e.exe
windows10_x64
10DusBrowserInst.exe
windows7_x64
6DusBrowserInst.exe
windows10_x64
6IDWCH2.exe
windows7_x64
8IDWCH2.exe
windows10_x64
8Litever01.exe
windows7_x64
10Litever01.exe
windows10_x64
10NAN.exe
windows7_x64
10NAN.exe
windows10_x64
10anyname.exe
windows7_x64
10anyname.exe
windows10_x64
10app.exe
windows7_x64
10app.exe
windows10_x64
10askinstall50.exe
windows7_x64
10askinstall50.exe
windows10_x64
10farlab_setup.exe
windows7_x64
10farlab_setup.exe
windows10_x64
10inst002.exe
windows7_x64
1inst002.exe
windows10_x64
1jamesnew.exe
windows7_x64
3jamesnew.exe
windows10_x64
3justdezine.exe
windows7_x64
10justdezine.exe
windows10_x64
10md3_3kvm.exe
windows7_x64
7md3_3kvm.exe
windows10_x64
7mixseven.exe
windows7_x64
9mixseven.exe
windows10_x64
10redcloud.exe
windows7_x64
1redcloud.exe
windows10_x64
1udptest.exe
windows7_x64
10udptest.exe
windows10_x64
10Analysis
-
max time kernel
137s -
max time network
132s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 18:21
Behavioral task
behavioral1
Sample
6c5db6dce13ded4e0e6c7e9a526b063e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
6c5db6dce13ded4e0e6c7e9a526b063e.exe
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
DusBrowserInst.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
DusBrowserInst.exe
Resource
win10-en-20210920
Behavioral task
behavioral5
Sample
IDWCH2.exe
Resource
win7-en-20210920
Behavioral task
behavioral6
Sample
IDWCH2.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
Litever01.exe
Resource
win7-en-20210920
Behavioral task
behavioral8
Sample
Litever01.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
NAN.exe
Resource
win7-en-20210920
Behavioral task
behavioral10
Sample
NAN.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
anyname.exe
Resource
win7-en-20210920
Behavioral task
behavioral12
Sample
anyname.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
app.exe
Resource
win7-en-20210920
Behavioral task
behavioral14
Sample
app.exe
Resource
win10-en-20210920
Behavioral task
behavioral15
Sample
askinstall50.exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
askinstall50.exe
Resource
win10-en-20210920
Behavioral task
behavioral17
Sample
farlab_setup.exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
farlab_setup.exe
Resource
win10-en-20210920
Behavioral task
behavioral19
Sample
inst002.exe
Resource
win7-en-20210920
Behavioral task
behavioral20
Sample
inst002.exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
jamesnew.exe
Resource
win7-en-20210920
Behavioral task
behavioral22
Sample
jamesnew.exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
justdezine.exe
Resource
win7-en-20210920
Behavioral task
behavioral24
Sample
justdezine.exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
md3_3kvm.exe
Resource
win7-en-20210920
Behavioral task
behavioral26
Sample
md3_3kvm.exe
Resource
win10-en-20210920
Behavioral task
behavioral27
Sample
mixseven.exe
Resource
win7v20210408
Behavioral task
behavioral28
Sample
mixseven.exe
Resource
win10-en-20210920
Behavioral task
behavioral29
Sample
redcloud.exe
Resource
win7v20210408
Behavioral task
behavioral30
Sample
redcloud.exe
Resource
win10-en-20210920
Behavioral task
behavioral31
Sample
udptest.exe
Resource
win7v20210408
Behavioral task
behavioral32
Sample
udptest.exe
Resource
win10-en-20210920
General
-
Target
askinstall50.exe
-
Size
1.4MB
-
MD5
68bc0c244bb2d261a9a7d007bb6e06d7
-
SHA1
4226d51ebf9d925de953e0a5a6b3784eabfc47b6
-
SHA256
fd53ca7be25f932d930f68ab7818359762dde5d3608271e7a27e815f5b30e9e4
-
SHA512
f52a04cd2a5d0f9f30be1b6827e95f5afe5f34d0453a78b000dd71d7d8e20467ef6f541a91858833704df6b1560cb5701eab08e5df0a86870b946b052cd6d9da
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1960 taskkill.exe -
Processes:
askinstall50.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 askinstall50.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde askinstall50.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
askinstall50.exetaskkill.exedescription pid process Token: SeCreateTokenPrivilege 1916 askinstall50.exe Token: SeAssignPrimaryTokenPrivilege 1916 askinstall50.exe Token: SeLockMemoryPrivilege 1916 askinstall50.exe Token: SeIncreaseQuotaPrivilege 1916 askinstall50.exe Token: SeMachineAccountPrivilege 1916 askinstall50.exe Token: SeTcbPrivilege 1916 askinstall50.exe Token: SeSecurityPrivilege 1916 askinstall50.exe Token: SeTakeOwnershipPrivilege 1916 askinstall50.exe Token: SeLoadDriverPrivilege 1916 askinstall50.exe Token: SeSystemProfilePrivilege 1916 askinstall50.exe Token: SeSystemtimePrivilege 1916 askinstall50.exe Token: SeProfSingleProcessPrivilege 1916 askinstall50.exe Token: SeIncBasePriorityPrivilege 1916 askinstall50.exe Token: SeCreatePagefilePrivilege 1916 askinstall50.exe Token: SeCreatePermanentPrivilege 1916 askinstall50.exe Token: SeBackupPrivilege 1916 askinstall50.exe Token: SeRestorePrivilege 1916 askinstall50.exe Token: SeShutdownPrivilege 1916 askinstall50.exe Token: SeDebugPrivilege 1916 askinstall50.exe Token: SeAuditPrivilege 1916 askinstall50.exe Token: SeSystemEnvironmentPrivilege 1916 askinstall50.exe Token: SeChangeNotifyPrivilege 1916 askinstall50.exe Token: SeRemoteShutdownPrivilege 1916 askinstall50.exe Token: SeUndockPrivilege 1916 askinstall50.exe Token: SeSyncAgentPrivilege 1916 askinstall50.exe Token: SeEnableDelegationPrivilege 1916 askinstall50.exe Token: SeManageVolumePrivilege 1916 askinstall50.exe Token: SeImpersonatePrivilege 1916 askinstall50.exe Token: SeCreateGlobalPrivilege 1916 askinstall50.exe Token: 31 1916 askinstall50.exe Token: 32 1916 askinstall50.exe Token: 33 1916 askinstall50.exe Token: 34 1916 askinstall50.exe Token: 35 1916 askinstall50.exe Token: SeDebugPrivilege 1960 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
askinstall50.execmd.exedescription pid process target process PID 1916 wrote to memory of 1356 1916 askinstall50.exe cmd.exe PID 1916 wrote to memory of 1356 1916 askinstall50.exe cmd.exe PID 1916 wrote to memory of 1356 1916 askinstall50.exe cmd.exe PID 1916 wrote to memory of 1356 1916 askinstall50.exe cmd.exe PID 1356 wrote to memory of 1960 1356 cmd.exe taskkill.exe PID 1356 wrote to memory of 1960 1356 cmd.exe taskkill.exe PID 1356 wrote to memory of 1960 1356 cmd.exe taskkill.exe PID 1356 wrote to memory of 1960 1356 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\askinstall50.exe"C:\Users\Admin\AppData\Local\Temp\askinstall50.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1960