Analysis
-
max time kernel
64s -
max time network
46s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07/02/2022, 02:43
Behavioral task
behavioral1
Sample
44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe
Resource
win10v2004-en-20220113
0 signatures
0 seconds
General
-
Target
44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe
-
Size
1.2MB
-
MD5
a0faa0ad11e26562d7c6440eadf5e890
-
SHA1
1f516e4d33cb30292042f0cb12c4cb6019d3c7ba
-
SHA256
44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2
-
SHA512
ab19f795083a64c1893f11cbb306f2aadca725b521dc89577692d783b57a19ad242c4a751509acb4a638eb720b4a38ef91f7ba17b509b8c6972302e019c6ea9c
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1668 2.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files\KeepVid\KeepVid Pro\__tmp_rar_sfx_access_check_188808 2.exe File created C:\Program Files\KeepVid\KeepVid Pro\KeepVidPro.exe 2.exe File opened for modification C:\Program Files\KeepVid\KeepVid Pro\KeepVidPro.exe 2.exe File created C:\Program Files\KeepVid\KeepVid Pro\CBSProductClient.dll 2.exe File opened for modification C:\Program Files\KeepVid\KeepVid Pro\CBSProductClient.dll 2.exe File opened for modification C:\Program Files\KeepVid 2.exe File opened for modification C:\Program Files\KeepVid\KeepVid Pro 2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1668 2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1388 1192 44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe 27 PID 1192 wrote to memory of 1388 1192 44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe 27 PID 1192 wrote to memory of 1388 1192 44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe 27 PID 1192 wrote to memory of 1388 1192 44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe 27 PID 1388 wrote to memory of 1668 1388 cmd.exe 29 PID 1388 wrote to memory of 1668 1388 cmd.exe 29 PID 1388 wrote to memory of 1668 1388 cmd.exe 29 PID 1388 wrote to memory of 1668 1388 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe"C:\Users\Admin\AppData\Local\Temp\44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D27A.tmp\D27B.bat C:\Users\Admin\AppData\Local\Temp\44e34dcb6bbd98f6bb1a254909c532183c7a5cb75f2e4d0b9e916e3ef6c24df2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\D27A.tmp\2.exe2.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1668
-
-