Analysis
-
max time kernel
78s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 12:16
Static task
static1
Behavioral task
behavioral1
Sample
3ec149660a6808f711ca6cb6b20c1dda.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3ec149660a6808f711ca6cb6b20c1dda.exe
Resource
win10-en-20211208
General
-
Target
3ec149660a6808f711ca6cb6b20c1dda.exe
-
Size
658KB
-
MD5
3ec149660a6808f711ca6cb6b20c1dda
-
SHA1
45c3d1d8dd512c01fd6c897c67b35c13c49828cb
-
SHA256
2d288f2cd6752a01360f2669959e2c61f676f8156d5cc40d4b415245ae04cf6d
-
SHA512
3a15e7bfbabeb296001086453320a133dc242ef170ccf45d459d2a7f402fadfe3329099d79b368416d565ba0c16eb051b64fe7b756c21f822ab49ec483b5649d
Malware Config
Signatures
-
suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P
suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P
-
suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download
suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download
-
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1
-
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M1
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M1
-
Executes dropped EXE 4 IoCs
Processes:
7zz.exeojbkcg.exe111.exe7z.exepid process 2252 7zz.exe 796 ojbkcg.exe 1060 111.exe 1796 7z.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
111.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation 111.exe -
Drops startup file 2 IoCs
Processes:
7z.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\╧╘┐¿╟²╢».lnk 7z.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\╧╘┐¿╟²╢».lnk 7z.exe -
Loads dropped DLL 2 IoCs
Processes:
ojbkcg.exe7z.exepid process 796 ojbkcg.exe 1796 7z.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
ojbkcg.exe111.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings ojbkcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 111.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3ec149660a6808f711ca6cb6b20c1dda.exepid process 2648 3ec149660a6808f711ca6cb6b20c1dda.exe 2648 3ec149660a6808f711ca6cb6b20c1dda.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
7z.exedescription pid process Token: SeRestorePrivilege 1796 7z.exe Token: 35 1796 7z.exe Token: SeSecurityPrivilege 1796 7z.exe Token: SeSecurityPrivilege 1796 7z.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
111.exepid process 1060 111.exe 1060 111.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3ec149660a6808f711ca6cb6b20c1dda.exe111.exedescription pid process target process PID 2648 wrote to memory of 2252 2648 3ec149660a6808f711ca6cb6b20c1dda.exe 7zz.exe PID 2648 wrote to memory of 2252 2648 3ec149660a6808f711ca6cb6b20c1dda.exe 7zz.exe PID 2648 wrote to memory of 2252 2648 3ec149660a6808f711ca6cb6b20c1dda.exe 7zz.exe PID 2648 wrote to memory of 796 2648 3ec149660a6808f711ca6cb6b20c1dda.exe ojbkcg.exe PID 2648 wrote to memory of 796 2648 3ec149660a6808f711ca6cb6b20c1dda.exe ojbkcg.exe PID 1060 wrote to memory of 1796 1060 111.exe 7z.exe PID 1060 wrote to memory of 1796 1060 111.exe 7z.exe PID 1060 wrote to memory of 1796 1060 111.exe 7z.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ec149660a6808f711ca6cb6b20c1dda.exe"C:\Users\Admin\AppData\Local\Temp\3ec149660a6808f711ca6cb6b20c1dda.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Public\Videos\1643631386\7zz.exe"C:\Users\Public\Videos\1643631386\7zz.exe" X -ep2 C:\Users\Public\Videos\1643631386\1.rar C:\Users\Public\Videos\16436313862⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Public\Videos\1643631386\ojbkcg.exe"C:\Users\Public\Videos\1643631386\ojbkcg.exe" -a2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:796
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3744
-
C:\Users\Public\Documents\auto\111.exe"C:\Users\Public\Documents\auto\111.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\ProgramData\7z.exe"C:\ProgramData\7z.exe" x C:\ProgramData\bb.zip -oC:\Users\Admin\AppData\Roaming\Microsoft\Windows2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1796
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
9ab5c0bbf40b2e1fc5f29a8e474dd215
SHA11d2716926c3c5086d7d10afdb5964b556e131993
SHA256f169d795ec6f5f75547655c79d359aca5f12834f3d79662865e82af902168f29
SHA5128a596e2aa516d3df834fa79803ace1cb8e2891f3e31876795fa40bda934ff6f97dc5023afcebf9f716c81cce498ce60bf6c1aec2ee079c13d9f534c1fa161f5b
-
MD5
6a9e619a0392bb5918306f7fbaa8c85b
SHA1d18d392e078e703ef7d9ec2a4f2042d7fbbf3863
SHA2563beecf3d764daaffc020ba89dd764b0215fbd360bfc115fbb3880ef0672b98e5
SHA512565c8f27395c41d4778debd0dec63d6fafb703255093d6ad5aea5d8b26f768f8b7ff7b2fa37a710179d3c1c0c0f47075a471c73584eb8941ee38b9ea25dcf809
-
MD5
c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
MD5
c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
MD5
fd6745c7e6659a134b2388b81f743eb8
SHA1175c4e2e49d86f4a84a5fb675a86460cbdd291c0
SHA256793d02326504985024cd6afa21f0e1555855b59bc3a63442f0c51337ba74720a
SHA51224611c0e585d330ff82561f3586aaa57b07c044dafd1d0513e2257ec53a4eb63a9989be2112e1c0ac5d20e62a2e3ebaa932bfa4c3e5c29d4c8aef68542c3e0f1
-
MD5
5ecefaea48c5a8498b036acd8ce411a5
SHA1501b3ed0fb6c33f6a122d603292d7fe04e8ce04f
SHA25688dd42dedc77e8ad117cc54d7b37083bbacaa6ecb84553bda31905b0a29e0e4d
SHA512e41a6bb1c734330dac37b9e7552053efdb46d15bf60601613baf8b5ab4be352c4d2f2d1c4e8bc4fe1616b98adfcf7b26336300b3bb724a9016e04d5820b2dd00
-
MD5
26d1f8cc33a7567463bfaebc2242833c
SHA11bd4fa5729c289a3ca1c4955f52464e4cc5ec4da
SHA256cb201744a0f50e72ee4fda9298785fa16bfc4bf639a9474457e429278ff376bc
SHA51201b3909272b3b25a9601cef11fd1122660a56b5220e8b3187c1b27135a23cc9aee9926761ce64ca9d8d872719da420131d83d4556c6255d20579be28d274b445
-
MD5
26d1f8cc33a7567463bfaebc2242833c
SHA11bd4fa5729c289a3ca1c4955f52464e4cc5ec4da
SHA256cb201744a0f50e72ee4fda9298785fa16bfc4bf639a9474457e429278ff376bc
SHA51201b3909272b3b25a9601cef11fd1122660a56b5220e8b3187c1b27135a23cc9aee9926761ce64ca9d8d872719da420131d83d4556c6255d20579be28d274b445
-
MD5
ee5768d7d9e319e36f17476d12450785
SHA1e08648361310618ea81b793411def40cef9e1745
SHA256e21a77a762b943102a0bd1cd9909b4f2c310889b1e3144a1a1e39fc4f09667bf
SHA512daff15ba6de59d2078dcaee5c381a71c2047bc18782a442c6c9ed83fcea3cb3f00f7a99ddf3092785fd7d7d8b70ee1009a717845074d354ebecac484442dae06
-
MD5
4ff2a1da304c3b06f05d3a6680b7da0b
SHA1fcb2b4b36942c0c1468ee51e9bf00d601af6baa7
SHA256da7d3f08ced662147da10d43d9cf8b567db2c87f2e4106435c3734e39791b5ed
SHA512a7e68f72a50d2b0ea57b556b73d83245de08e69d63f824ed0bdfc08bdf82302f7f367963d26382ec2a4ed859b900ed542f1bb527a3608a6a0e60f7ad952bbf74
-
MD5
b6ee97ccbebb6c4d06e1a7a7bb4ee1c8
SHA17451e21a49529eb7e42fc5fc03d6980fabc00c44
SHA25687d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699
SHA512060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12
-
MD5
f2ae502d448cfb81a5f40a9368d99b1a
SHA1f849be86e9e7ced0acd51a68f92992b8090d08a5
SHA25607ad4b984f288304003b080dd013784685181de4353a0b70a0247f96e535bd56
SHA5129f3aea471684e22bf9fc045ca0e47a8429fa0b13c188f9c7a51937efa8afcec976761b0c4c95aed7735096fcc2278bbd86b0ab581261a6aff6c694d7bb65e9be
-
MD5
fb08e726e7a526d4620b4093d3b3cd41
SHA109d800bd9da9f4ce0b372423527925742b001d95
SHA2566aafac6b731ccae8a5f184d692076f5582d6af6459cdbd46299b2fd5bcf60f2b
SHA5126c74b1a879460576a1917e155a010d528458958ae468a25c56781c0d5cc19a97b0bb7434523765d3591e6ccf60588e970558b8acbc62f7446b8b6145c2356c6c
-
MD5
fb08e726e7a526d4620b4093d3b3cd41
SHA109d800bd9da9f4ce0b372423527925742b001d95
SHA2566aafac6b731ccae8a5f184d692076f5582d6af6459cdbd46299b2fd5bcf60f2b
SHA5126c74b1a879460576a1917e155a010d528458958ae468a25c56781c0d5cc19a97b0bb7434523765d3591e6ccf60588e970558b8acbc62f7446b8b6145c2356c6c
-
MD5
c36bb659f08f046b139c8d1b980bf1ac
SHA1dd3247b225a8da3161f76055f31cbc5f64a66086
SHA256405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4
SHA5123eeae6a3b424fa1709b4443f625ee99fa2d2861661214b868d36bf5a63c0aaac61ad3bdd9c4b18cb9d820ef89653787df812289d31d65415c4dd08fd45d0c73f
-
MD5
5ecefaea48c5a8498b036acd8ce411a5
SHA1501b3ed0fb6c33f6a122d603292d7fe04e8ce04f
SHA25688dd42dedc77e8ad117cc54d7b37083bbacaa6ecb84553bda31905b0a29e0e4d
SHA512e41a6bb1c734330dac37b9e7552053efdb46d15bf60601613baf8b5ab4be352c4d2f2d1c4e8bc4fe1616b98adfcf7b26336300b3bb724a9016e04d5820b2dd00
-
MD5
6a9e619a0392bb5918306f7fbaa8c85b
SHA1d18d392e078e703ef7d9ec2a4f2042d7fbbf3863
SHA2563beecf3d764daaffc020ba89dd764b0215fbd360bfc115fbb3880ef0672b98e5
SHA512565c8f27395c41d4778debd0dec63d6fafb703255093d6ad5aea5d8b26f768f8b7ff7b2fa37a710179d3c1c0c0f47075a471c73584eb8941ee38b9ea25dcf809
-
MD5
b6ee97ccbebb6c4d06e1a7a7bb4ee1c8
SHA17451e21a49529eb7e42fc5fc03d6980fabc00c44
SHA25687d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699
SHA512060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12