Analysis
-
max time kernel
135s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19-01-2022 16:33
Static task
static1
Behavioral task
behavioral1
Sample
c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe
-
Size
5.0MB
-
MD5
dbe9736b562b2bcce0b531fdfeaded32
-
SHA1
a36ac4af321f97964885b801601aaee816f405d1
-
SHA256
c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240
-
SHA512
9dc69b482a510482b6aa6992924daf39b96bb43ab9017d6919120288e3d7936717b21aa24cd12c51d64d446eecc626bdc0ddfd0222cff5fde8010d110edea849
Malware Config
Extracted
Family
arkei
Botnet
Default
C2
http://185.215.113.39/7vlcKuayFx.php
Signatures
-
Babadeda Crypter 1 IoCs
resource yara_rule behavioral2/files/0x0006000000022131-142.dat family_babadeda -
Arkei Stealer Payload 1 IoCs
resource yara_rule behavioral2/memory/2244-143-0x0000000000400000-0x0000000000BBD000-memory.dmp family_arkei -
Executes dropped EXE 3 IoCs
pid Process 1552 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp 3824 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp 2244 evreporter.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp -
Loads dropped DLL 1 IoCs
pid Process 2244 evreporter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3824 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp 3824 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3824 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3480 wrote to memory of 1552 3480 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe 51 PID 3480 wrote to memory of 1552 3480 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe 51 PID 3480 wrote to memory of 1552 3480 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe 51 PID 1552 wrote to memory of 1720 1552 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp 52 PID 1552 wrote to memory of 1720 1552 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp 52 PID 1552 wrote to memory of 1720 1552 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp 52 PID 1720 wrote to memory of 3824 1720 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe 53 PID 1720 wrote to memory of 3824 1720 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe 53 PID 1720 wrote to memory of 3824 1720 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe 53 PID 3824 wrote to memory of 2244 3824 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp 56 PID 3824 wrote to memory of 2244 3824 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp 56 PID 3824 wrote to memory of 2244 3824 c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp 56
Processes
-
C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\is-6FDAK.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp"C:\Users\Admin\AppData\Local\Temp\is-6FDAK.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$80182,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe"C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT3⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\is-H1ITM.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp"C:\Users\Admin\AppData\Local\Temp\is-H1ITM.tmp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.tmp" /SL5="$9004C,4382530,831488,C:\Users\Admin\AppData\Local\Temp\c920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe"C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244
-
-
-
-