Overview
overview
10Static
static
10001.exe
windows7_x64
10001.exe
windows10-2004_x64
101488.exe
windows7_x64
101488.exe
windows10-2004_x64
11_cr.exe
windows7_x64
51_cr.exe
windows10-2004_x64
41cr.exe
windows7_x64
101cr.exe
windows10-2004_x64
41fc2d.exe
windows7_x64
101fc2d.exe
windows10-2004_x64
106e7_2021-0...04.exe
windows7_x64
106e7_2021-0...04.exe
windows10-2004_x64
10Abjects.exe
windows7_x64
1Abjects.exe
windows10-2004_x64
4BattleText.exe
windows7_x64
10BattleText.exe
windows10-2004_x64
1HANS.exe
windows7_x64
3HANS.exe
windows10-2004_x64
1Hulu.exe
windows7_x64
8Hulu.exe
windows10-2004_x64
8IntelFIVE.exe
windows7_x64
3IntelFIVE.exe
windows10-2004_x64
7IntelFOUR.exe
windows7_x64
3IntelFOUR.exe
windows10-2004_x64
7IntelONE.exe
windows7_x64
3IntelONE.exe
windows10-2004_x64
7IntelTHREE.exe
windows7_x64
3IntelTHREE.exe
windows10-2004_x64
7IntelTWO.exe
windows7_x64
3IntelTWO.exe
windows10-2004_x64
7Lucky_Fixed.exe
windows7_x64
3Lucky_Fixed.exe
windows10-2004_x64
10Resubmissions
07-02-2022 00:34
220207-aw81qsdce2 10Analysis
-
max time kernel
151s -
max time network
163s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07-02-2022 00:34
Behavioral task
behavioral1
Sample
001.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral2
Sample
001.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral3
Sample
1488.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral4
Sample
1488.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral5
Sample
1_cr.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral6
Sample
1_cr.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral7
Sample
1cr.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral8
Sample
1cr.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral9
Sample
1fc2d.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral10
Sample
1fc2d.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral11
Sample
6e7_2021-01-19_18-04.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral12
Sample
6e7_2021-01-19_18-04.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral13
Sample
Abjects.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral14
Sample
Abjects.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral15
Sample
BattleText.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral16
Sample
BattleText.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral17
Sample
HANS.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral18
Sample
HANS.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral19
Sample
Hulu.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral20
Sample
Hulu.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral21
Sample
IntelFIVE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral22
Sample
IntelFIVE.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral23
Sample
IntelFOUR.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral24
Sample
IntelFOUR.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral25
Sample
IntelONE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral26
Sample
IntelONE.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral27
Sample
IntelTHREE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral28
Sample
IntelTHREE.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral29
Sample
IntelTWO.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral30
Sample
IntelTWO.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral31
Sample
Lucky_Fixed.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral32
Sample
Lucky_Fixed.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
General
-
Target
Hulu.exe
-
Size
1.4MB
-
MD5
64be5264f3a58325446865be38c05b34
-
SHA1
fdbad9468075747a4999b7b30fa7cb7b60fdcb4e
-
SHA256
561a8b830e902a0ba18457a0aa8db8a8c663de8ee33e6009f236cedff00f8cbb
-
SHA512
d48fac03082d1f12cf1d175978f64e9d2df467828601b34474c77bf139c6c0dae5002ad2f1e106c46e6fb6c4ef8083e011931a74dd0adcbb0a43cdeae16cd0d0
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 832 Custodiva.exe.com 1324 Custodiva.exe.com 1060 RegAsm.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GRyYpiVyQV.url Custodiva.exe.com -
Loads dropped DLL 3 IoCs
pid Process 1452 cmd.exe 1324 Custodiva.exe.com 1060 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1324 set thread context of 1060 1324 Custodiva.exe.com 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 656 PING.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1496 2028 Hulu.exe 27 PID 2028 wrote to memory of 1496 2028 Hulu.exe 27 PID 2028 wrote to memory of 1496 2028 Hulu.exe 27 PID 2028 wrote to memory of 1496 2028 Hulu.exe 27 PID 2028 wrote to memory of 1584 2028 Hulu.exe 29 PID 2028 wrote to memory of 1584 2028 Hulu.exe 29 PID 2028 wrote to memory of 1584 2028 Hulu.exe 29 PID 2028 wrote to memory of 1584 2028 Hulu.exe 29 PID 1584 wrote to memory of 1452 1584 cmd.exe 31 PID 1584 wrote to memory of 1452 1584 cmd.exe 31 PID 1584 wrote to memory of 1452 1584 cmd.exe 31 PID 1584 wrote to memory of 1452 1584 cmd.exe 31 PID 1452 wrote to memory of 1628 1452 cmd.exe 32 PID 1452 wrote to memory of 1628 1452 cmd.exe 32 PID 1452 wrote to memory of 1628 1452 cmd.exe 32 PID 1452 wrote to memory of 1628 1452 cmd.exe 32 PID 1452 wrote to memory of 832 1452 cmd.exe 33 PID 1452 wrote to memory of 832 1452 cmd.exe 33 PID 1452 wrote to memory of 832 1452 cmd.exe 33 PID 1452 wrote to memory of 832 1452 cmd.exe 33 PID 1452 wrote to memory of 656 1452 cmd.exe 34 PID 1452 wrote to memory of 656 1452 cmd.exe 34 PID 1452 wrote to memory of 656 1452 cmd.exe 34 PID 1452 wrote to memory of 656 1452 cmd.exe 34 PID 832 wrote to memory of 1324 832 Custodiva.exe.com 35 PID 832 wrote to memory of 1324 832 Custodiva.exe.com 35 PID 832 wrote to memory of 1324 832 Custodiva.exe.com 35 PID 832 wrote to memory of 1324 832 Custodiva.exe.com 35 PID 1324 wrote to memory of 1060 1324 Custodiva.exe.com 38 PID 1324 wrote to memory of 1060 1324 Custodiva.exe.com 38 PID 1324 wrote to memory of 1060 1324 Custodiva.exe.com 38 PID 1324 wrote to memory of 1060 1324 Custodiva.exe.com 38 PID 1324 wrote to memory of 1060 1324 Custodiva.exe.com 38 PID 1324 wrote to memory of 1060 1324 Custodiva.exe.com 38 PID 1324 wrote to memory of 1060 1324 Custodiva.exe.com 38 PID 1324 wrote to memory of 1060 1324 Custodiva.exe.com 38 PID 1324 wrote to memory of 1060 1324 Custodiva.exe.com 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hulu.exe"C:\Users\Admin\AppData\Local\Temp\Hulu.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo xlEPMOAZC2⤵PID:1496
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe < Strazii.xlsm2⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^unowfSGqElRNjSdIsHGXTopdtGkBtbAqMZrTUgLOVVaETGrALikdphrYfSXIHyWiJRqhPbOeWSeXPEbbDKPWjlRmWyDwsruPYkUwFPLgzoxdlypLcmyWfqVmqBsKTMLSLjYEJcRNZBDrPAgQW$" Nel.xlm4⤵PID:1628
-
-
C:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\Custodiva.exe.comCustodiva.exe.com x4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\Custodiva.exe.comC:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\Custodiva.exe.com x5⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\RegAsm.exeC:\Users\Admin\AppData\Roaming\rzVBBfiLGjYqEZEI\RegAsm.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
PID:656
-
-
-