Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
22/11/2021, 12:51
Static task
static1
Behavioral task
behavioral1
Sample
d9552a15a61f255df3206b63ee0383be.exe
Resource
win7-en-20211104
General
-
Target
d9552a15a61f255df3206b63ee0383be.exe
-
Size
554KB
-
MD5
d9552a15a61f255df3206b63ee0383be
-
SHA1
7c76e2edcf184b90d40003dac71b08e3a3ed2e8c
-
SHA256
0cdd906491990c6ba9c24bdd60172057587859a8e649ba7f4b51fece9a0fdac6
-
SHA512
0ce1db824d226df28177b6e5394fa1f8483333583d8332680d4cf0cfc8627a53d69c1c857b319dd200e0f38bf88d445a4289d78472fe3167cc39ae6a85f21599
Malware Config
Signatures
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International\Geo\Nation d9552a15a61f255df3206b63ee0383be.exe -
Loads dropped DLL 1 IoCs
pid Process 320 d9552a15a61f255df3206b63ee0383be.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ipinfo.io 15 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1848 320 WerFault.exe 26 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 320 d9552a15a61f255df3206b63ee0383be.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1848 WerFault.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe 1660 biD0OZHIgKoNAZH8V3gPgiIL.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1848 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1848 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 320 wrote to memory of 1660 320 d9552a15a61f255df3206b63ee0383be.exe 30 PID 320 wrote to memory of 1660 320 d9552a15a61f255df3206b63ee0383be.exe 30 PID 320 wrote to memory of 1660 320 d9552a15a61f255df3206b63ee0383be.exe 30 PID 320 wrote to memory of 1660 320 d9552a15a61f255df3206b63ee0383be.exe 30 PID 320 wrote to memory of 1848 320 d9552a15a61f255df3206b63ee0383be.exe 31 PID 320 wrote to memory of 1848 320 d9552a15a61f255df3206b63ee0383be.exe 31 PID 320 wrote to memory of 1848 320 d9552a15a61f255df3206b63ee0383be.exe 31 PID 320 wrote to memory of 1848 320 d9552a15a61f255df3206b63ee0383be.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9552a15a61f255df3206b63ee0383be.exe"C:\Users\Admin\AppData\Local\Temp\d9552a15a61f255df3206b63ee0383be.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\Pictures\Adobe Films\biD0OZHIgKoNAZH8V3gPgiIL.exe"C:\Users\Admin\Pictures\Adobe Films\biD0OZHIgKoNAZH8V3gPgiIL.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 14082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1848
-