Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 14:58
Static task
static1
Behavioral task
behavioral1
Sample
fef94d43785bb65b22223999176aee30.exe
Resource
win7-en-20210920
General
-
Target
fef94d43785bb65b22223999176aee30.exe
-
Size
66KB
-
MD5
fef94d43785bb65b22223999176aee30
-
SHA1
e0909b279e64aedad50e4184bff28b6e1d1f4d99
-
SHA256
711596144e0595c7a7b4ce14657415f14a6966eadbaa4efbaea49f9cea746465
-
SHA512
0c70fb0fee26840accae862d6fd8f1692bb283042372f889b62f3363c85f6e5d0c8e414e72a3b0a3bbaa4c06b47ba27b5235bb03ab82c5e0dc3147d29c4f6c99
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 6 IoCs
Processes:
4703983.exe6743162.exe4145107.exe7841290.exe8311815.exeWinHoster.exepid process 3340 4703983.exe 3004 6743162.exe 2892 4145107.exe 508 7841290.exe 1580 8311815.exe 2408 WinHoster.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
4145107.exe6743162.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4145107.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4145107.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6743162.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6743162.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\6743162.exe themida C:\Users\Admin\AppData\Roaming\6743162.exe themida C:\Users\Admin\AppData\Roaming\4145107.exe themida C:\Users\Admin\AppData\Roaming\4145107.exe themida behavioral2/memory/3004-153-0x00000000012D0000-0x00000000012D1000-memory.dmp themida behavioral2/memory/2892-156-0x0000000000A90000-0x0000000000A91000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7841290.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 7841290.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
6743162.exe4145107.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6743162.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4145107.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
6743162.exe4145107.exepid process 3004 6743162.exe 2892 4145107.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
4703983.exe6743162.exe4145107.exe8311815.exepid process 3340 4703983.exe 3004 6743162.exe 3004 6743162.exe 2892 4145107.exe 2892 4145107.exe 1580 8311815.exe 3340 4703983.exe 1580 8311815.exe 3004 6743162.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
fef94d43785bb65b22223999176aee30.exe4703983.exe8311815.exe6743162.exe4145107.exedescription pid process Token: SeDebugPrivilege 1420 fef94d43785bb65b22223999176aee30.exe Token: SeDebugPrivilege 3340 4703983.exe Token: SeDebugPrivilege 1580 8311815.exe Token: SeDebugPrivilege 3004 6743162.exe Token: SeDebugPrivilege 2892 4145107.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
fef94d43785bb65b22223999176aee30.exe7841290.exedescription pid process target process PID 1420 wrote to memory of 3340 1420 fef94d43785bb65b22223999176aee30.exe 4703983.exe PID 1420 wrote to memory of 3340 1420 fef94d43785bb65b22223999176aee30.exe 4703983.exe PID 1420 wrote to memory of 3340 1420 fef94d43785bb65b22223999176aee30.exe 4703983.exe PID 1420 wrote to memory of 3004 1420 fef94d43785bb65b22223999176aee30.exe 6743162.exe PID 1420 wrote to memory of 3004 1420 fef94d43785bb65b22223999176aee30.exe 6743162.exe PID 1420 wrote to memory of 3004 1420 fef94d43785bb65b22223999176aee30.exe 6743162.exe PID 1420 wrote to memory of 2892 1420 fef94d43785bb65b22223999176aee30.exe 4145107.exe PID 1420 wrote to memory of 2892 1420 fef94d43785bb65b22223999176aee30.exe 4145107.exe PID 1420 wrote to memory of 2892 1420 fef94d43785bb65b22223999176aee30.exe 4145107.exe PID 1420 wrote to memory of 508 1420 fef94d43785bb65b22223999176aee30.exe 7841290.exe PID 1420 wrote to memory of 508 1420 fef94d43785bb65b22223999176aee30.exe 7841290.exe PID 1420 wrote to memory of 508 1420 fef94d43785bb65b22223999176aee30.exe 7841290.exe PID 1420 wrote to memory of 1580 1420 fef94d43785bb65b22223999176aee30.exe 8311815.exe PID 1420 wrote to memory of 1580 1420 fef94d43785bb65b22223999176aee30.exe 8311815.exe PID 1420 wrote to memory of 1580 1420 fef94d43785bb65b22223999176aee30.exe 8311815.exe PID 508 wrote to memory of 2408 508 7841290.exe WinHoster.exe PID 508 wrote to memory of 2408 508 7841290.exe WinHoster.exe PID 508 wrote to memory of 2408 508 7841290.exe WinHoster.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fef94d43785bb65b22223999176aee30.exe"C:\Users\Admin\AppData\Local\Temp\fef94d43785bb65b22223999176aee30.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Roaming\4703983.exe"C:\Users\Admin\AppData\Roaming\4703983.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3340 -
C:\Users\Admin\AppData\Roaming\6743162.exe"C:\Users\Admin\AppData\Roaming\6743162.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004 -
C:\Users\Admin\AppData\Roaming\4145107.exe"C:\Users\Admin\AppData\Roaming\4145107.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892 -
C:\Users\Admin\AppData\Roaming\7841290.exe"C:\Users\Admin\AppData\Roaming\7841290.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Roaming\8311815.exe"C:\Users\Admin\AppData\Roaming\8311815.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\4145107.exeMD5
65af30e5183ec3ed5bbd2bb01a84c70d
SHA10c80dd39c6f549d223580d0de4cac24e16bc2b4d
SHA256e8dfd805239ea832e78569f203b2f097560387960395396b870ab2ab66e620d7
SHA512290e6ea2f1c402a3002f58047852a3507a28910a416973b86c73ffbf62f85b7d5e3803a05a7ba66b4f167757c75908b35c275e29ed7ccb2f440ab1fcd7b91944
-
C:\Users\Admin\AppData\Roaming\4145107.exeMD5
65af30e5183ec3ed5bbd2bb01a84c70d
SHA10c80dd39c6f549d223580d0de4cac24e16bc2b4d
SHA256e8dfd805239ea832e78569f203b2f097560387960395396b870ab2ab66e620d7
SHA512290e6ea2f1c402a3002f58047852a3507a28910a416973b86c73ffbf62f85b7d5e3803a05a7ba66b4f167757c75908b35c275e29ed7ccb2f440ab1fcd7b91944
-
C:\Users\Admin\AppData\Roaming\4703983.exeMD5
b000b6fab1932dd4ef495be9aff97ce6
SHA1bb268db4c14470dcfa20bd57d91b30b163f34298
SHA25646406f0615c1f330788c4271a32c244859e5bc4ef2d83fc1cf4484fd10454422
SHA512ac80bf00cdf53073af9bcbf2240a551a4e3832f8dcc2381f5d325cc73e7782823f11e3e7c31716510b0af5572f146ca756babc8b95347ddaca82937c01acd29a
-
C:\Users\Admin\AppData\Roaming\4703983.exeMD5
b000b6fab1932dd4ef495be9aff97ce6
SHA1bb268db4c14470dcfa20bd57d91b30b163f34298
SHA25646406f0615c1f330788c4271a32c244859e5bc4ef2d83fc1cf4484fd10454422
SHA512ac80bf00cdf53073af9bcbf2240a551a4e3832f8dcc2381f5d325cc73e7782823f11e3e7c31716510b0af5572f146ca756babc8b95347ddaca82937c01acd29a
-
C:\Users\Admin\AppData\Roaming\6743162.exeMD5
7b02c8c409875e573df30c0d6ba41f32
SHA16153e93cf304d7a01c14c3d000d7acf99869ca3c
SHA256f430f969b29f02eb51dabf223bf91dea6a3bf790af55fe49d5e36073cdd342e8
SHA51229f4ab0bd8b343d95aee94ec3e411fe6dde85d50d980bcbe8c0ae2aea0c9b1f6fb4822bb1622c8fe4c3fde26c9c91985e44cbaf7e8f6a15fbed60952fbfbb181
-
C:\Users\Admin\AppData\Roaming\6743162.exeMD5
7b02c8c409875e573df30c0d6ba41f32
SHA16153e93cf304d7a01c14c3d000d7acf99869ca3c
SHA256f430f969b29f02eb51dabf223bf91dea6a3bf790af55fe49d5e36073cdd342e8
SHA51229f4ab0bd8b343d95aee94ec3e411fe6dde85d50d980bcbe8c0ae2aea0c9b1f6fb4822bb1622c8fe4c3fde26c9c91985e44cbaf7e8f6a15fbed60952fbfbb181
-
C:\Users\Admin\AppData\Roaming\7841290.exeMD5
9ec6ecf38cb040515dd99edc3e964c10
SHA196013003c9055983f9e9411613364d6c29169738
SHA25680db68b4b0216a5371497f59d688d88108efe0bbf3d3fea1b969cde9ce8d4168
SHA5121a7746ddf8f0a660fe4fa6b7fce03c922f2c027550388dd50910d2969ca6390b5b792644dcfd6562ef2ac44b74940547c6281806b30772cfa41415722f7eb323
-
C:\Users\Admin\AppData\Roaming\7841290.exeMD5
9ec6ecf38cb040515dd99edc3e964c10
SHA196013003c9055983f9e9411613364d6c29169738
SHA25680db68b4b0216a5371497f59d688d88108efe0bbf3d3fea1b969cde9ce8d4168
SHA5121a7746ddf8f0a660fe4fa6b7fce03c922f2c027550388dd50910d2969ca6390b5b792644dcfd6562ef2ac44b74940547c6281806b30772cfa41415722f7eb323
-
C:\Users\Admin\AppData\Roaming\8311815.exeMD5
bae62464dcabed11f92664a980b25a8d
SHA145d9d713c1d0415f73b224f42fa80f772f8ad434
SHA25663a1722ff99b52778675943c9462258e13349469ebd0977aaf5aec471fbfb1b2
SHA512f2a5fdd5fc21e4fde6e26bbb87e43171517cf214e186268f0c52341ba7e3554a64f6982ddb57731f3ebf67fd3ab4be0c3fd5135f6e52ef887df70662bc9c5f68
-
C:\Users\Admin\AppData\Roaming\8311815.exeMD5
bae62464dcabed11f92664a980b25a8d
SHA145d9d713c1d0415f73b224f42fa80f772f8ad434
SHA25663a1722ff99b52778675943c9462258e13349469ebd0977aaf5aec471fbfb1b2
SHA512f2a5fdd5fc21e4fde6e26bbb87e43171517cf214e186268f0c52341ba7e3554a64f6982ddb57731f3ebf67fd3ab4be0c3fd5135f6e52ef887df70662bc9c5f68
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
9ec6ecf38cb040515dd99edc3e964c10
SHA196013003c9055983f9e9411613364d6c29169738
SHA25680db68b4b0216a5371497f59d688d88108efe0bbf3d3fea1b969cde9ce8d4168
SHA5121a7746ddf8f0a660fe4fa6b7fce03c922f2c027550388dd50910d2969ca6390b5b792644dcfd6562ef2ac44b74940547c6281806b30772cfa41415722f7eb323
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
9ec6ecf38cb040515dd99edc3e964c10
SHA196013003c9055983f9e9411613364d6c29169738
SHA25680db68b4b0216a5371497f59d688d88108efe0bbf3d3fea1b969cde9ce8d4168
SHA5121a7746ddf8f0a660fe4fa6b7fce03c922f2c027550388dd50910d2969ca6390b5b792644dcfd6562ef2ac44b74940547c6281806b30772cfa41415722f7eb323
-
memory/508-136-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/508-140-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/508-133-0x0000000000000000-mapping.dmp
-
memory/508-142-0x000000000A790000-0x000000000A791000-memory.dmpFilesize
4KB
-
memory/1420-117-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/1420-118-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/1420-115-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1580-167-0x000000000D9A0000-0x000000000D9A1000-memory.dmpFilesize
4KB
-
memory/1580-149-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/1580-139-0x0000000000000000-mapping.dmp
-
memory/1580-170-0x0000000002970000-0x0000000002971000-memory.dmpFilesize
4KB
-
memory/1580-163-0x000000000A450000-0x000000000A498000-memory.dmpFilesize
288KB
-
memory/1580-158-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/2408-186-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/2408-181-0x000000000AA60000-0x000000000AA61000-memory.dmpFilesize
4KB
-
memory/2408-174-0x0000000009F40000-0x0000000009F41000-memory.dmpFilesize
4KB
-
memory/2408-159-0x0000000000000000-mapping.dmp
-
memory/2892-146-0x00000000772E0000-0x000000007746E000-memory.dmpFilesize
1.6MB
-
memory/2892-183-0x0000000005BC0000-0x0000000005BC1000-memory.dmpFilesize
4KB
-
memory/2892-199-0x0000000007400000-0x0000000007401000-memory.dmpFilesize
4KB
-
memory/2892-156-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/2892-197-0x0000000007320000-0x0000000007321000-memory.dmpFilesize
4KB
-
memory/2892-190-0x0000000005C00000-0x0000000005C01000-memory.dmpFilesize
4KB
-
memory/2892-188-0x0000000005CD0000-0x0000000005CD1000-memory.dmpFilesize
4KB
-
memory/2892-130-0x0000000000000000-mapping.dmp
-
memory/3004-187-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/3004-162-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/3004-208-0x00000000083B0000-0x00000000083B1000-memory.dmpFilesize
4KB
-
memory/3004-153-0x00000000012D0000-0x00000000012D1000-memory.dmpFilesize
4KB
-
memory/3004-145-0x00000000772E0000-0x000000007746E000-memory.dmpFilesize
1.6MB
-
memory/3004-171-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/3004-175-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/3004-127-0x0000000000000000-mapping.dmp
-
memory/3340-126-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/3340-144-0x000000000E010000-0x000000000E011000-memory.dmpFilesize
4KB
-
memory/3340-184-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/3340-147-0x000000000E710000-0x000000000E711000-memory.dmpFilesize
4KB
-
memory/3340-122-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/3340-124-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/3340-125-0x0000000005330000-0x0000000005379000-memory.dmpFilesize
292KB
-
memory/3340-132-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/3340-168-0x000000000E1E0000-0x000000000E1E1000-memory.dmpFilesize
4KB
-
memory/3340-119-0x0000000000000000-mapping.dmp