Resubmissions
23-10-2021 15:52
211023-tbkbesdcfm 1022-10-2021 17:40
211022-v8trsscggr 1022-10-2021 15:55
211022-tc9ygacgan 1022-10-2021 14:38
211022-rz1bfabgb8 10Analysis
-
max time kernel
491s -
max time network
413s -
platform
windows7_x64 -
resource
win7-de-20211014 -
submitted
22-10-2021 14:38
Static task
static1
Behavioral task
behavioral1
Sample
Fri051e1e7444.exe
Resource
win7-ja-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Fri051e1e7444.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
Fri051e1e7444.exe
Resource
win7-de-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
Fri051e1e7444.exe
Resource
win11
icedidraccoonredlinesmokeloadersocelarsvidarxmrig1875681804backdoorbankerdiscoveryevasioninfostealerminerpersistencespywarestealerthemidatrojan
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
Fri051e1e7444.exe
Resource
win10-ja-20211014
djvuicedidnetsupportraccoonredlinesmokeloadersocelarsvidarxmrig7c9b4504a63ed23664e38808e65948379b790395874dee7d322070fc6dc34b3b6cd43904077db44d916921937james2221875681804backdoorbankerdiscoveryevasioninfostealerminerpersistenceransomwareratspywarestealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
Fri051e1e7444.exe
Resource
win10-en-20210920
djvuicedidraccoonredlinesmokeloadersocelarsvidarxmrig7c9b4504a63ed23664e38808e65948379b790395874dee7d322070fc6dc34b3b6cd43904077db44d9169219339371875681804backdoorbankerdiscoveryevasioninfostealerminerpersistenceransomwarespywarestealerthemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
Fri051e1e7444.exe
Resource
win10-de-20210920
djvuicedidraccoonredlinesmokeloadersocelarsvidarxmrigzloader7c9b4504a63ed23664e38808e65948379b790395874dee7d322070fc6dc34b3b6cd43904077db44d916921937james2221875681804backdoorbankerbotnetdiscoveryevasioninfostealerminerpersistenceransomwarespywarestealerthemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
Fri051e1e7444.exe
-
Size
403KB
-
MD5
b4c503088928eef0e973a269f66a0dd2
-
SHA1
eb7f418b03aa9f21275de0393fcbf0d03b9719d5
-
SHA256
2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
-
SHA512
c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\International\Geo\Nation Fri051e1e7444.exe -
Loads dropped DLL 1 IoCs
pid Process 460 Fri051e1e7444.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ipinfo.io 15 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1496 460 WerFault.exe 26 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 460 Fri051e1e7444.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe 1496 WerFault.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe 1756 PDUo7jmxbPpiG0eT_Guv8GrG.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1496 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1496 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 460 wrote to memory of 1756 460 Fri051e1e7444.exe 29 PID 460 wrote to memory of 1756 460 Fri051e1e7444.exe 29 PID 460 wrote to memory of 1756 460 Fri051e1e7444.exe 29 PID 460 wrote to memory of 1756 460 Fri051e1e7444.exe 29 PID 460 wrote to memory of 1496 460 Fri051e1e7444.exe 30 PID 460 wrote to memory of 1496 460 Fri051e1e7444.exe 30 PID 460 wrote to memory of 1496 460 Fri051e1e7444.exe 30 PID 460 wrote to memory of 1496 460 Fri051e1e7444.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe"C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\Pictures\Adobe Films\PDUo7jmxbPpiG0eT_Guv8GrG.exe"C:\Users\Admin\Pictures\Adobe Films\PDUo7jmxbPpiG0eT_Guv8GrG.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 6202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1496
-