Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
19/11/2021, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Resource
win10-en-20211014
General
-
Target
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
-
Size
403KB
-
MD5
f957e397e71010885b67f2afe37d8161
-
SHA1
a8bf84b971b37ac6e7f66c5e5a7e971a7741401e
-
SHA256
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66
-
SHA512
8b5e9cb926fafc295c403c1fce7aa883db3a327e58c3295e9a081a8937bed28e305cca08c2c7d98080818095ea99bb4047e10aa2f61e3e4d6d965aef6d16a4f6
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International\Geo\Nation 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe -
Loads dropped DLL 1 IoCs
pid Process 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ipinfo.io 17 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1764 360 WerFault.exe 26 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1764 WerFault.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe 1100 IXFyXZcFGEOl97KhXGBBzUtq.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1764 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1764 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 360 wrote to memory of 1100 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 30 PID 360 wrote to memory of 1100 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 30 PID 360 wrote to memory of 1100 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 30 PID 360 wrote to memory of 1100 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 30 PID 360 wrote to memory of 1764 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 31 PID 360 wrote to memory of 1764 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 31 PID 360 wrote to memory of 1764 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 31 PID 360 wrote to memory of 1764 360 022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\Pictures\Adobe Films\IXFyXZcFGEOl97KhXGBBzUtq.exe"C:\Users\Admin\Pictures\Adobe Films\IXFyXZcFGEOl97KhXGBBzUtq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 360 -s 14242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1764
-