15a3129f051ad017ee69714a834e3c3dbec9c9e334662090864e5056affc1c3b

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-en-20211104
submitted
26-11-2021 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

regolamento.bin.exe
Size

391KB
MD5

5644517be1634a30b9c32c75d52c7aa6
SHA1

5047b5d7e2f352e9ba6efe47e6bc805550d3552d
SHA256

b034243fc2a42e0c5dd70de9fa6c16d13fc1702330d68d3f885213064fd722d2
SHA512

a173922181e5890ac0723c51cb724c7d2885892d925314d08c4203d5e0aef5af746f42bde6e94566aaba3cd3bde623457b3f5a3b6d00abafee952de0daacba84

Score

8^/10

ransomware spyware stealer

Malware Config

Signatures

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

regolamento.bin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\RemoveWrite.tiff.amogus	regolamento.bin.exe
File renamed	C:\Users\Admin\Pictures\MeasureLock.crw => C:\Users\Admin\Pictures\MeasureLock.crw.amogus	regolamento.bin.exe
File renamed	C:\Users\Admin\Pictures\MountRemove.crw => C:\Users\Admin\Pictures\MountRemove.crw.amogus	regolamento.bin.exe
File opened for modification	C:\Users\Admin\Pictures\RegisterSkip.png.amogus	regolamento.bin.exe
File renamed	C:\Users\Admin\Pictures\SendConvertTo.tif => C:\Users\Admin\Pictures\SendConvertTo.tif.amogus	regolamento.bin.exe
File opened for modification	C:\Users\Admin\Pictures\MeasureLock.crw.amogus	regolamento.bin.exe
File opened for modification	C:\Users\Admin\Pictures\MountRemove.crw.amogus	regolamento.bin.exe
File opened for modification	C:\Users\Admin\Pictures\SearchTrace.raw.amogus	regolamento.bin.exe
File opened for modification	C:\Users\Admin\Pictures\SearchWatch.tiff.amogus	regolamento.bin.exe
File opened for modification	C:\Users\Admin\Pictures\SendConvertTo.tif.amogus	regolamento.bin.exe
File renamed	C:\Users\Admin\Pictures\RegisterSkip.png => C:\Users\Admin\Pictures\RegisterSkip.png.amogus	regolamento.bin.exe
File renamed	C:\Users\Admin\Pictures\SearchTrace.raw => C:\Users\Admin\Pictures\SearchTrace.raw.amogus	regolamento.bin.exe
File renamed	C:\Users\Admin\Pictures\RemoveWrite.tiff => C:\Users\Admin\Pictures\RemoveWrite.tiff.amogus	regolamento.bin.exe
File renamed	C:\Users\Admin\Pictures\SearchWatch.tiff => C:\Users\Admin\Pictures\SearchWatch.tiff.amogus	regolamento.bin.exe

Drops startup file 1 IoCs

Processes:

regolamento.bin.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.amogus regolamento.bin.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: RenamesItself 1 IoCs

Processes:

regolamento.bin.exe

pid process

1592 regolamento.bin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.amogus	regolamento.bin.exe

pid	process
1592	regolamento.bin.exe

C:\Users\Admin\AppData\Local\Temp\regolamento.bin.exe
"C:\Users\Admin\AppData\Local\Temp\regolamento.bin.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious behavior: RenamesItself
PID:1592

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads