Overview
overview
10Static
static
10setup_inst...32.exe
windows7_x64
10setup_inst...32.exe
windows10_x64
10setup_inst...2b.exe
windows7_x64
8setup_inst...2b.exe
windows10_x64
8setup_inst...61.exe
windows7_x64
10setup_inst...61.exe
windows10_x64
10setup_inst...f8.exe
windows7_x64
10setup_inst...f8.exe
windows10_x64
10setup_inst...34.exe
windows7_x64
10setup_inst...34.exe
windows10_x64
10setup_inst...c2.exe
windows7_x64
3setup_inst...c2.exe
windows10_x64
10setup_inst...cb.exe
windows7_x64
10setup_inst...cb.exe
windows10_x64
10setup_inst...90.exe
windows7_x64
10setup_inst...90.exe
windows10_x64
10setup_inst...79.exe
windows7_x64
6setup_inst...79.exe
windows10_x64
6setup_inst...d8.exe
windows7_x64
7setup_inst...d8.exe
windows10_x64
3setup_inst...3b.exe
windows7_x64
8setup_inst...3b.exe
windows10_x64
8setup_inst...ac.exe
windows7_x64
10setup_inst...ac.exe
windows10_x64
10setup_inst...38.exe
windows7_x64
10setup_inst...38.exe
windows10_x64
10setup_inst...b5.exe
windows7_x64
10setup_inst...b5.exe
windows10_x64
10setup_inst...b2.exe
windows7_x64
7setup_inst...b2.exe
windows10_x64
7setup_inst...rl.dll
windows7_x64
3setup_inst...rl.dll
windows10_x64
3Analysis
-
max time kernel
118s -
max time network
154s -
submitted
01-01-1970 00:00
Behavioral task
behavioral1
Sample
setup_installer/Wed0901eb1dae126e32.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
setup_installer/Wed0901eb1dae126e32.exe
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
setup_installer/Wed094c47c32b.exe
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
setup_installer/Wed094c47c32b.exe
Resource
win10-en-20210920
Behavioral task
behavioral5
Sample
setup_installer/Wed096a1bff61.exe
Resource
win7-en-20211014
Behavioral task
behavioral6
Sample
setup_installer/Wed096a1bff61.exe
Resource
win10-en-20210920
Behavioral task
behavioral7
Sample
setup_installer/Wed0971f17486f8.exe
Resource
win7-en-20210920
Behavioral task
behavioral8
Sample
setup_installer/Wed0971f17486f8.exe
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
setup_installer/Wed09977fdc12334.exe
Resource
win7-en-20210920
Behavioral task
behavioral10
Sample
setup_installer/Wed09977fdc12334.exe
Resource
win10-en-20211014
Behavioral task
behavioral11
Sample
setup_installer/Wed09abf83d9c2.exe
Resource
win7-en-20210920
Behavioral task
behavioral12
Sample
setup_installer/Wed09abf83d9c2.exe
Resource
win10-en-20210920
Behavioral task
behavioral13
Sample
setup_installer/Wed09b2a8bc4f16cb.exe
Resource
win7-en-20211014
Behavioral task
behavioral14
Sample
setup_installer/Wed09b2a8bc4f16cb.exe
Resource
win10-en-20210920
Behavioral task
behavioral15
Sample
setup_installer/Wed09b3a5ca1a712d390.exe
Resource
win7-en-20211014
Behavioral task
behavioral16
Sample
setup_installer/Wed09b3a5ca1a712d390.exe
Resource
win10-en-20210920
Behavioral task
behavioral17
Sample
setup_installer/Wed09c42cad92c20f79.exe
Resource
win7-en-20211014
Behavioral task
behavioral18
Sample
setup_installer/Wed09c42cad92c20f79.exe
Resource
win10-en-20210920
Behavioral task
behavioral19
Sample
setup_installer/Wed09cfb2f9758281d8.exe
Resource
win7-en-20211014
Behavioral task
behavioral20
Sample
setup_installer/Wed09cfb2f9758281d8.exe
Resource
win10-en-20210920
Behavioral task
behavioral21
Sample
setup_installer/Wed09d27135e5a8b3b.exe
Resource
win7-en-20210920
Behavioral task
behavioral22
Sample
setup_installer/Wed09d27135e5a8b3b.exe
Resource
win10-en-20211014
Behavioral task
behavioral23
Sample
setup_installer/Wed09d8d6edfaff2ac.exe
Resource
win7-en-20210920
Behavioral task
behavioral24
Sample
setup_installer/Wed09d8d6edfaff2ac.exe
Resource
win10-en-20211014
Behavioral task
behavioral25
Sample
setup_installer/Wed09db0d52c38.exe
Resource
win7-en-20210920
Behavioral task
behavioral26
Sample
setup_installer/Wed09db0d52c38.exe
Resource
win10-en-20210920
Behavioral task
behavioral27
Sample
setup_installer/Wed09e95ff6b5.exe
Resource
win7-en-20211014
Behavioral task
behavioral28
Sample
setup_installer/Wed09e95ff6b5.exe
Resource
win10-en-20210920
Behavioral task
behavioral29
Sample
setup_installer/Wed09f257bb7877d00b2.exe
Resource
win7-en-20211014
Behavioral task
behavioral30
Sample
setup_installer/Wed09f257bb7877d00b2.exe
Resource
win10-en-20210920
Behavioral task
behavioral31
Sample
setup_installer/libcurl.dll
Resource
win7-en-20211014
Behavioral task
behavioral32
Sample
setup_installer/libcurl.dll
Resource
win10-en-20210920
General
-
Target
setup_installer/Wed09d27135e5a8b3b.exe
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
Wed09d27135e5a8b3b.tmpWed09d27135e5a8b3b.tmppostback.exepid process 2276 Wed09d27135e5a8b3b.tmp 1632 Wed09d27135e5a8b3b.tmp 4652 postback.exe -
Loads dropped DLL 2 IoCs
Processes:
Wed09d27135e5a8b3b.tmpWed09d27135e5a8b3b.tmppid process 2276 Wed09d27135e5a8b3b.tmp 1632 Wed09d27135e5a8b3b.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
Processes:
Wed09d27135e5a8b3b.tmpdescription ioc process File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat Wed09d27135e5a8b3b.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-K0DD2.tmp Wed09d27135e5a8b3b.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat Wed09d27135e5a8b3b.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Wed09d27135e5a8b3b.tmppid process 1632 Wed09d27135e5a8b3b.tmp 1632 Wed09d27135e5a8b3b.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Wed09d27135e5a8b3b.tmppid process 1632 Wed09d27135e5a8b3b.tmp -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Wed09d27135e5a8b3b.exeWed09d27135e5a8b3b.tmpWed09d27135e5a8b3b.exeWed09d27135e5a8b3b.tmpdescription pid process target process PID 1840 wrote to memory of 2276 1840 Wed09d27135e5a8b3b.exe Wed09d27135e5a8b3b.tmp PID 1840 wrote to memory of 2276 1840 Wed09d27135e5a8b3b.exe Wed09d27135e5a8b3b.tmp PID 1840 wrote to memory of 2276 1840 Wed09d27135e5a8b3b.exe Wed09d27135e5a8b3b.tmp PID 2276 wrote to memory of 4436 2276 Wed09d27135e5a8b3b.tmp Wed09d27135e5a8b3b.exe PID 2276 wrote to memory of 4436 2276 Wed09d27135e5a8b3b.tmp Wed09d27135e5a8b3b.exe PID 2276 wrote to memory of 4436 2276 Wed09d27135e5a8b3b.tmp Wed09d27135e5a8b3b.exe PID 4436 wrote to memory of 1632 4436 Wed09d27135e5a8b3b.exe Wed09d27135e5a8b3b.tmp PID 4436 wrote to memory of 1632 4436 Wed09d27135e5a8b3b.exe Wed09d27135e5a8b3b.tmp PID 4436 wrote to memory of 1632 4436 Wed09d27135e5a8b3b.exe Wed09d27135e5a8b3b.tmp PID 1632 wrote to memory of 4652 1632 Wed09d27135e5a8b3b.tmp postback.exe PID 1632 wrote to memory of 4652 1632 Wed09d27135e5a8b3b.tmp postback.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09d27135e5a8b3b.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09d27135e5a8b3b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MS28I.tmp\Wed09d27135e5a8b3b.tmp"C:\Users\Admin\AppData\Local\Temp\is-MS28I.tmp\Wed09d27135e5a8b3b.tmp" /SL5="$3013A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09d27135e5a8b3b.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09d27135e5a8b3b.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09d27135e5a8b3b.exe" /SILENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4HBTB.tmp\Wed09d27135e5a8b3b.tmp"C:\Users\Admin\AppData\Local\Temp\is-4HBTB.tmp\Wed09d27135e5a8b3b.tmp" /SL5="$7005C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09d27135e5a8b3b.exe" /SILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-S7CJA.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-S7CJA.tmp\postback.exe" ss15⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-4HBTB.tmp\Wed09d27135e5a8b3b.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-4HBTB.tmp\Wed09d27135e5a8b3b.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-MS28I.tmp\Wed09d27135e5a8b3b.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-MS28I.tmp\Wed09d27135e5a8b3b.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-S7CJA.tmp\postback.exeMD5
b3bb91ad96f2d4c041861ce59ba6ac73
SHA1e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3
SHA2560581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426
SHA512e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd
-
C:\Users\Admin\AppData\Local\Temp\is-S7CJA.tmp\postback.exeMD5
b3bb91ad96f2d4c041861ce59ba6ac73
SHA1e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3
SHA2560581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426
SHA512e3a8426d202a8aad79aad5d75549753cf70b9c2c0fa4c9468f03d089eca8e529b56cd8fa16b7be3a4cfc019d43ff458b9dc8a1cae44b6ed75e27f21489a2cbdd
-
\Users\Admin\AppData\Local\Temp\is-DGMF2.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-S7CJA.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
memory/1632-127-0x0000000000000000-mapping.dmp
-
memory/1632-131-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1840-119-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2276-123-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2276-120-0x0000000000000000-mapping.dmp
-
memory/4436-125-0x0000000000000000-mapping.dmp
-
memory/4436-130-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4652-133-0x0000000000000000-mapping.dmp