Analysis
-
max time kernel
189s -
max time network
180s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 04:51
General
-
Target
65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe
-
Size
9.2MB
-
MD5
2b9ef4ae5ebd8429d6d84c894ecc8fab
-
SHA1
eca4cebc30fcc93ee073185a7a6b2862c116fbd2
-
SHA256
65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab
-
SHA512
43f378cb70537a0cc30458a7044fb9cfa0debbfe43cdaeee96f4fc3d829370119fa0703460fff49c952fe0d7edc61033e57e0b2b5fdefeb13b4b643ff80355f0
Malware Config
Signatures
-
StrongPity
StrongPity is a spyware developed by PROMETHIUM APT group mainly used in government sponsored attacks.
-
StrongPity Spyware 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 4 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 52 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe"C:\Users\Admin\AppData\Local\Temp\65041a83c88ba90e489de8ac275688815c51b93ae568c627b74fc160d2db6bab.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe"C:\Users\Admin\AppData\Local\Temp\intervpnmix2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe"C:\Program Files (x86)\Innovative Solutions\Intervpn\OpenVPN\bin\Intervpn\vpnpro.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe"C:\Users\Admin\AppData\Local\Temp\Opera\sivsnui.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe"C:\Users\Admin\AppData\Local\Temp\Opera\srvolpsm.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB