Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
09-01-2022 14:50
Static task
static1
Behavioral task
behavioral1
Sample
2145121fd426cf719e3b418108bb0215.exe
Resource
win7-en-20211208
General
-
Target
2145121fd426cf719e3b418108bb0215.exe
-
Size
2.7MB
-
MD5
2145121fd426cf719e3b418108bb0215
-
SHA1
256d36d145d164f7c97d667cc35592f27d6aa8ea
-
SHA256
d36d4465c570673839d1139e66b284072a9d9f88ea7e2733c1751bd77e9afb2c
-
SHA512
de0794d204e269f4b79cd42678b6c7493b94348f0388685c9759f3a762e5d8bf1d8f0eba5d3398e2d66975e98d4b7ae270c16f13d6034dcd8d7f029150765cc0
Malware Config
Extracted
cryptbot
zyodef72.top
morvue07.top
-
payload_url
http://yapkbc10.top/download.php?file=luzhou.exe
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
File.exeDpEditor.exepid process 2164 File.exe 1660 DpEditor.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
File.exeDpEditor.exe2145121fd426cf719e3b418108bb0215.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion File.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DpEditor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DpEditor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2145121fd426cf719e3b418108bb0215.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2145121fd426cf719e3b418108bb0215.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion File.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/492-116-0x00000000002A0000-0x000000000099B000-memory.dmp themida behavioral2/memory/492-117-0x00000000002A0000-0x000000000099B000-memory.dmp themida behavioral2/memory/492-118-0x00000000002A0000-0x000000000099B000-memory.dmp themida behavioral2/memory/492-119-0x00000000002A0000-0x000000000099B000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\File.exe themida C:\Users\Admin\AppData\Local\Temp\File.exe themida behavioral2/memory/2164-140-0x00000000009F0000-0x00000000010E3000-memory.dmp themida behavioral2/memory/2164-141-0x00000000009F0000-0x00000000010E3000-memory.dmp themida behavioral2/memory/2164-142-0x00000000009F0000-0x00000000010E3000-memory.dmp themida behavioral2/memory/2164-143-0x00000000009F0000-0x00000000010E3000-memory.dmp themida C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe themida C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe themida behavioral2/memory/1660-147-0x0000000000070000-0x0000000000763000-memory.dmp themida behavioral2/memory/1660-148-0x0000000000070000-0x0000000000763000-memory.dmp themida behavioral2/memory/1660-149-0x0000000000070000-0x0000000000763000-memory.dmp themida behavioral2/memory/1660-150-0x0000000000070000-0x0000000000763000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
2145121fd426cf719e3b418108bb0215.exeFile.exeDpEditor.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2145121fd426cf719e3b418108bb0215.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA File.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DpEditor.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
2145121fd426cf719e3b418108bb0215.exeFile.exeDpEditor.exepid process 492 2145121fd426cf719e3b418108bb0215.exe 2164 File.exe 1660 DpEditor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2145121fd426cf719e3b418108bb0215.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2145121fd426cf719e3b418108bb0215.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2145121fd426cf719e3b418108bb0215.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 392 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
DpEditor.exepid process 1660 DpEditor.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2145121fd426cf719e3b418108bb0215.exeFile.exeDpEditor.exepid process 492 2145121fd426cf719e3b418108bb0215.exe 492 2145121fd426cf719e3b418108bb0215.exe 2164 File.exe 2164 File.exe 1660 DpEditor.exe 1660 DpEditor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2145121fd426cf719e3b418108bb0215.execmd.exeFile.exedescription pid process target process PID 492 wrote to memory of 2164 492 2145121fd426cf719e3b418108bb0215.exe File.exe PID 492 wrote to memory of 2164 492 2145121fd426cf719e3b418108bb0215.exe File.exe PID 492 wrote to memory of 2164 492 2145121fd426cf719e3b418108bb0215.exe File.exe PID 492 wrote to memory of 1208 492 2145121fd426cf719e3b418108bb0215.exe cmd.exe PID 492 wrote to memory of 1208 492 2145121fd426cf719e3b418108bb0215.exe cmd.exe PID 492 wrote to memory of 1208 492 2145121fd426cf719e3b418108bb0215.exe cmd.exe PID 1208 wrote to memory of 392 1208 cmd.exe timeout.exe PID 1208 wrote to memory of 392 1208 cmd.exe timeout.exe PID 1208 wrote to memory of 392 1208 cmd.exe timeout.exe PID 2164 wrote to memory of 1660 2164 File.exe DpEditor.exe PID 2164 wrote to memory of 1660 2164 File.exe DpEditor.exe PID 2164 wrote to memory of 1660 2164 File.exe DpEditor.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2145121fd426cf719e3b418108bb0215.exe"C:\Users\Admin\AppData\Local\Temp\2145121fd426cf719e3b418108bb0215.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2145121fd426cf719e3b418108bb0215.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\File.exeMD5
3ae6147ee830216aa9e60610a5a46409
SHA1e56fe77b928782d7de59323a1d2543059f820a30
SHA256067d79883c880e8d3a0c77d0f211abe52991e00aff3489cd04c5b5180125fb65
SHA512c256d66f909dd75322890d4b21b86559f04f877768994e011b9e0030c57a9d72637799f291da8a7e67aa71aecd4faf5fb02c76a97a6fcbbbef680b3489b3d2c4
-
C:\Users\Admin\AppData\Local\Temp\File.exeMD5
3ae6147ee830216aa9e60610a5a46409
SHA1e56fe77b928782d7de59323a1d2543059f820a30
SHA256067d79883c880e8d3a0c77d0f211abe52991e00aff3489cd04c5b5180125fb65
SHA512c256d66f909dd75322890d4b21b86559f04f877768994e011b9e0030c57a9d72637799f291da8a7e67aa71aecd4faf5fb02c76a97a6fcbbbef680b3489b3d2c4
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\EGCZDT~1.ZIPMD5
55958ed3fdb1abddccdea677a7603c23
SHA17440db92e3d15279a9f5667e02d7194bf1d0ac81
SHA256bb4418e3f06fcf5a4655d86c56d694ea828ccc916619b7fff17faa8847523de8
SHA5129f2ba6f8354c2dd4848fee0997783a0a0f3be4f73301af9d7806f7ad23c45d354a8dafa867e1113f2106f52dc200362d266a78a89d097294b6a73ce4764401e1
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\WATNAW~1.ZIPMD5
7371306c73febd72ce79b7478ccb4a7f
SHA1591c4ba9a0d2ef9305e3aedf4282295b2811df21
SHA256fc1b848d5474ce3d2f7c80f6442c3d6f67a4e612680e2be2f687733e09cf9fdd
SHA512d3dd0432628c6e25375b05fcc5c91bb90f7a29afb449b1bbdb0d323f2a9c75d0a6fc427158f4fff796c7dd604d23a7a50426465ff60b1e70bda9b8b430959755
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\_Files\_Chrome\DEFAUL~1.BINMD5
09500b419541e759ce53d87e324fe8fc
SHA14b882732508d2fc28536f8281c3b58777720c7da
SHA256f80e7db7d3a06c87f03f5d0a9c7ab592ef05bc4fa5a8ab65c318c8455bd94476
SHA51245e04f6283559638be00bffaf1a52a52a6998f835d5d40f756806a2323623074cb7ee9f802f4eba7d7523ccf3170f8986f89349ffbc1f2514ce25fdae0114fde
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\_Files\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\_Files\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\_Files\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\_Files\_INFOR~1.TXTMD5
dc0cade45df1db9fd8c05481c508fbee
SHA1d8066868c7332cc453e5fa467fb2a6939a1b022a
SHA256040c3d4c7e41275e5bc68165481966a412b1b18dbc21be472c70198d6a53fe8b
SHA51221e54b24fdaef5e50c26f4dbf7b795321cb71f8986ea0ae7242bfdec9ebe7df18a6e56a7aebd186a6799d4efed4ee57a2a178eb5403e6e93cd2f740b3ea99c0d
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\_Files\_SCREE~1.JPEMD5
b40b624057647d36ee50281c2b007b26
SHA19ec6ac0563f71b229bd191c5460fe462aaaef0eb
SHA25601ee50540b3f2f26ecd712d1eff62675576ac139a2220c12498318c40b0fdc14
SHA5128e6d572697081c20aad4ad29fe72d02c4cc267761145cb612fde03492cf0f09b069f569afd1f8656f3f5938d49915e7949402be6ee27bd06b4a7e022230f5057
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\files_\SCREEN~1.JPGMD5
b40b624057647d36ee50281c2b007b26
SHA19ec6ac0563f71b229bd191c5460fe462aaaef0eb
SHA25601ee50540b3f2f26ecd712d1eff62675576ac139a2220c12498318c40b0fdc14
SHA5128e6d572697081c20aad4ad29fe72d02c4cc267761145cb612fde03492cf0f09b069f569afd1f8656f3f5938d49915e7949402be6ee27bd06b4a7e022230f5057
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\files_\SYSTEM~1.TXTMD5
dc0cade45df1db9fd8c05481c508fbee
SHA1d8066868c7332cc453e5fa467fb2a6939a1b022a
SHA256040c3d4c7e41275e5bc68165481966a412b1b18dbc21be472c70198d6a53fe8b
SHA51221e54b24fdaef5e50c26f4dbf7b795321cb71f8986ea0ae7242bfdec9ebe7df18a6e56a7aebd186a6799d4efed4ee57a2a178eb5403e6e93cd2f740b3ea99c0d
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\files_\_Chrome\DEFAUL~1.BINMD5
09500b419541e759ce53d87e324fe8fc
SHA14b882732508d2fc28536f8281c3b58777720c7da
SHA256f80e7db7d3a06c87f03f5d0a9c7ab592ef05bc4fa5a8ab65c318c8455bd94476
SHA51245e04f6283559638be00bffaf1a52a52a6998f835d5d40f756806a2323623074cb7ee9f802f4eba7d7523ccf3170f8986f89349ffbc1f2514ce25fdae0114fde
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\files_\_Chrome\DEFAUL~1.DBMD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\files_\_Chrome\DEFAUL~2.DBMD5
055c8c5c47424f3c2e7a6fc2ee904032
SHA15952781d22cff35d94861fac25d89a39af6d0a87
SHA256531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a
SHA512c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a
-
C:\Users\Admin\AppData\Local\Temp\PVxqnDaTVLBUe\files_\_Chrome\DEFAUL~3.DBMD5
8ee018331e95a610680a789192a9d362
SHA1e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9
SHA25694354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575
SHA5124b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4
-
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exeMD5
3ae6147ee830216aa9e60610a5a46409
SHA1e56fe77b928782d7de59323a1d2543059f820a30
SHA256067d79883c880e8d3a0c77d0f211abe52991e00aff3489cd04c5b5180125fb65
SHA512c256d66f909dd75322890d4b21b86559f04f877768994e011b9e0030c57a9d72637799f291da8a7e67aa71aecd4faf5fb02c76a97a6fcbbbef680b3489b3d2c4
-
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exeMD5
3ae6147ee830216aa9e60610a5a46409
SHA1e56fe77b928782d7de59323a1d2543059f820a30
SHA256067d79883c880e8d3a0c77d0f211abe52991e00aff3489cd04c5b5180125fb65
SHA512c256d66f909dd75322890d4b21b86559f04f877768994e011b9e0030c57a9d72637799f291da8a7e67aa71aecd4faf5fb02c76a97a6fcbbbef680b3489b3d2c4
-
memory/392-138-0x0000000000000000-mapping.dmp
-
memory/492-116-0x00000000002A0000-0x000000000099B000-memory.dmpFilesize
7.0MB
-
memory/492-115-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/492-119-0x00000000002A0000-0x000000000099B000-memory.dmpFilesize
7.0MB
-
memory/492-117-0x00000000002A0000-0x000000000099B000-memory.dmpFilesize
7.0MB
-
memory/492-118-0x00000000002A0000-0x000000000099B000-memory.dmpFilesize
7.0MB
-
memory/1208-123-0x0000000000000000-mapping.dmp
-
memory/1660-151-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/1660-150-0x0000000000070000-0x0000000000763000-memory.dmpFilesize
6.9MB
-
memory/1660-149-0x0000000000070000-0x0000000000763000-memory.dmpFilesize
6.9MB
-
memory/1660-148-0x0000000000070000-0x0000000000763000-memory.dmpFilesize
6.9MB
-
memory/1660-147-0x0000000000070000-0x0000000000763000-memory.dmpFilesize
6.9MB
-
memory/1660-144-0x0000000000000000-mapping.dmp
-
memory/2164-120-0x0000000000000000-mapping.dmp
-
memory/2164-143-0x00000000009F0000-0x00000000010E3000-memory.dmpFilesize
6.9MB
-
memory/2164-142-0x00000000009F0000-0x00000000010E3000-memory.dmpFilesize
6.9MB
-
memory/2164-141-0x00000000009F0000-0x00000000010E3000-memory.dmpFilesize
6.9MB
-
memory/2164-140-0x00000000009F0000-0x00000000010E3000-memory.dmpFilesize
6.9MB
-
memory/2164-139-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB