Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
19/11/2021, 22:21
Static task
static1
Behavioral task
behavioral1
Sample
4ac90fcd66a546b3d454ac36071cd80628664314.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
4ac90fcd66a546b3d454ac36071cd80628664314.exe
Resource
win10-en-20211104
General
-
Target
4ac90fcd66a546b3d454ac36071cd80628664314.exe
-
Size
554KB
-
MD5
2492148eff76c565ffd2f40d9091e947
-
SHA1
4ac90fcd66a546b3d454ac36071cd80628664314
-
SHA256
7be418280356c7dc0384328a50904f3cee364185aa7f99e127e511461cd6db5c
-
SHA512
4fde132cb712716ea62b6fb112575b059cca8bc9a1c257eb414e73fd3bab2ec352b7c9bc5ba5e1fa8b1bbfbf0e00928097720c3dc4add6b6f895afddeb06bd47
Malware Config
Signatures
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1624 br7FGBc6KSFHcCPj2yb4C93s.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International\Geo\Nation 4ac90fcd66a546b3d454ac36071cd80628664314.exe -
Loads dropped DLL 1 IoCs
pid Process 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ipinfo.io 15 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1444 996 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1444 WerFault.exe 1444 WerFault.exe 1444 WerFault.exe 1444 WerFault.exe 1444 WerFault.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe 1624 br7FGBc6KSFHcCPj2yb4C93s.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1444 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1444 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 996 wrote to memory of 1624 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe 30 PID 996 wrote to memory of 1624 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe 30 PID 996 wrote to memory of 1624 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe 30 PID 996 wrote to memory of 1624 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe 30 PID 996 wrote to memory of 1444 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe 31 PID 996 wrote to memory of 1444 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe 31 PID 996 wrote to memory of 1444 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe 31 PID 996 wrote to memory of 1444 996 4ac90fcd66a546b3d454ac36071cd80628664314.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ac90fcd66a546b3d454ac36071cd80628664314.exe"C:\Users\Admin\AppData\Local\Temp\4ac90fcd66a546b3d454ac36071cd80628664314.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\Pictures\Adobe Films\br7FGBc6KSFHcCPj2yb4C93s.exe"C:\Users\Admin\Pictures\Adobe Films\br7FGBc6KSFHcCPj2yb4C93s.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 14082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1444
-