Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12/02/2022, 07:17
Static task
static1
Behavioral task
behavioral1
Sample
46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe
Resource
win7-en-20211208
General
-
Target
46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe
-
Size
1013KB
-
MD5
ce7fea497e325ef4b82a6eee9a96db8f
-
SHA1
30e151ba95e25642bdcaafa78f6aba0cd3833173
-
SHA256
46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607
-
SHA512
4f80c8a091caf70adf51456d412701bb53f75a67f18b92af2b8d831c2b6442075ebd9801a8bb6db9008936a0c4e82c9155654709a572d57c32e853c4b44d5be1
Malware Config
Extracted
cryptbot
hevpxm41.top
morosf04.top
-
payload_url
http://kyrgvz05.top/download.php?file=kulmet.exe
Signatures
-
Deletes itself 1 IoCs
pid Process 1828 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1704 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1828 1888 46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe 29 PID 1888 wrote to memory of 1828 1888 46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe 29 PID 1888 wrote to memory of 1828 1888 46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe 29 PID 1888 wrote to memory of 1828 1888 46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe 29 PID 1828 wrote to memory of 1704 1828 cmd.exe 31 PID 1828 wrote to memory of 1704 1828 cmd.exe 31 PID 1828 wrote to memory of 1704 1828 cmd.exe 31 PID 1828 wrote to memory of 1704 1828 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe"C:\Users\Admin\AppData\Local\Temp\46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\aGhLZMiSQ & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\46ef9917a72794e5f99021e65c831a3342710426d53e40c218f2257b02042607.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
PID:1704
-
-