Sun038db98f99bf9a.exe

General
Target

Sun038db98f99bf9a.exe

Filesize

172KB

Completed

31-10-2021 20:24

Score
10/10
MD5

7c3cf9ce3ffb1e5dd48896fdc9080bab

SHA1

34b4976f8f83c1e0a9d277d2a103a61616178728

SHA256

b3049882301853eed2aa8c5ac99010dd84292d7e092eb6f4311fa535716f5d83

Malware Config
Signatures 13

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • Downloads MZ/PE file
  • Executes dropped EXE
    WVwHAvukxz9IAyy_JsFP949h.exe

    Reported IOCs

    pidprocess
    1300WVwHAvukxz9IAyy_JsFP949h.exe
  • Checks computer location settings
    Sun038db98f99bf9a.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\NationSun038db98f99bf9a.exe
  • Loads dropped DLL
    Sun038db98f99bf9a.exe

    Reported IOCs

    pidprocess
    868Sun038db98f99bf9a.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    14ipinfo.io
    15ipinfo.io
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    1364868WerFault.exeSun038db98f99bf9a.exe
  • Suspicious behavior: EnumeratesProcesses
    Sun038db98f99bf9a.exeWVwHAvukxz9IAyy_JsFP949h.exeWerFault.exe

    Reported IOCs

    pidprocess
    868Sun038db98f99bf9a.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1364WerFault.exe
    1364WerFault.exe
    1364WerFault.exe
    1364WerFault.exe
    1364WerFault.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
    1300WVwHAvukxz9IAyy_JsFP949h.exe
  • Suspicious behavior: GetForegroundWindowSpam
    WerFault.exe

    Reported IOCs

    pidprocess
    1364WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1364WerFault.exe
  • Suspicious use of WriteProcessMemory
    Sun038db98f99bf9a.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 868 wrote to memory of 1300868Sun038db98f99bf9a.exeWVwHAvukxz9IAyy_JsFP949h.exe
    PID 868 wrote to memory of 1300868Sun038db98f99bf9a.exeWVwHAvukxz9IAyy_JsFP949h.exe
    PID 868 wrote to memory of 1300868Sun038db98f99bf9a.exeWVwHAvukxz9IAyy_JsFP949h.exe
    PID 868 wrote to memory of 1300868Sun038db98f99bf9a.exeWVwHAvukxz9IAyy_JsFP949h.exe
    PID 868 wrote to memory of 1364868Sun038db98f99bf9a.exeWerFault.exe
    PID 868 wrote to memory of 1364868Sun038db98f99bf9a.exeWerFault.exe
    PID 868 wrote to memory of 1364868Sun038db98f99bf9a.exeWerFault.exe
    PID 868 wrote to memory of 1364868Sun038db98f99bf9a.exeWerFault.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\Sun038db98f99bf9a.exe
    "C:\Users\Admin\AppData\Local\Temp\Sun038db98f99bf9a.exe"
    Checks computer location settings
    Loads dropped DLL
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:868
    • C:\Users\Admin\Pictures\Adobe Films\WVwHAvukxz9IAyy_JsFP949h.exe
      "C:\Users\Admin\Pictures\Adobe Films\WVwHAvukxz9IAyy_JsFP949h.exe"
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1300
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 1404
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1364
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\Pictures\Adobe Films\WVwHAvukxz9IAyy_JsFP949h.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • \Users\Admin\Pictures\Adobe Films\WVwHAvukxz9IAyy_JsFP949h.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • memory/868-54-0x0000000076201000-0x0000000076203000-memory.dmp

                • memory/868-55-0x0000000003BB0000-0x0000000003CFA000-memory.dmp

                • memory/1300-57-0x0000000000000000-mapping.dmp

                • memory/1364-59-0x0000000000000000-mapping.dmp

                • memory/1364-60-0x0000000000320000-0x0000000000321000-memory.dmp