Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12/02/2022, 08:34
Static task
static1
Behavioral task
behavioral1
Sample
3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
Resource
win7-en-20211208
General
-
Target
3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe
-
Size
8.4MB
-
MD5
01916ff0453c0730f2a6f4a822840722
-
SHA1
1616f0667616e90847d0585923ba1af1773371ab
-
SHA256
3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7
-
SHA512
b296150c4cecff1324db41a61ab18b3944a27972abf1f752720efe62f803f56f2d1a4917b96f560e28238dcfc472300749e090a45575a40772af98303226c8a4
Malware Config
Extracted
cryptbot
tisysc64.top
morvak06.top
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 5 IoCs
pid Process 464 Setup.exe 924 Setup1.exe 1688 KMSpico.exe 1552 KMSpico.tmp 1404 DpEditor.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DpEditor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DpEditor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup1.exe -
Loads dropped DLL 15 IoCs
pid Process 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 1688 KMSpico.exe 1552 KMSpico.tmp 1552 KMSpico.tmp 924 Setup1.exe -
resource yara_rule behavioral1/files/0x0006000000013327-61.dat themida behavioral1/files/0x0006000000013327-64.dat themida behavioral1/files/0x0006000000013327-63.dat themida behavioral1/files/0x0006000000013327-65.dat themida behavioral1/memory/924-86-0x0000000000DF0000-0x00000000014D0000-memory.dmp themida behavioral1/memory/924-87-0x0000000000DF0000-0x00000000014D0000-memory.dmp themida behavioral1/memory/924-88-0x0000000000DF0000-0x00000000014D0000-memory.dmp themida behavioral1/files/0x0006000000013327-90.dat themida behavioral1/files/0x000600000001393d-91.dat themida behavioral1/files/0x000600000001393d-92.dat themida behavioral1/memory/1404-94-0x0000000000CE0000-0x00000000013C0000-memory.dmp themida behavioral1/memory/1404-95-0x0000000000CE0000-0x00000000013C0000-memory.dmp themida behavioral1/memory/1404-96-0x0000000000CE0000-0x00000000013C0000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup1.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DpEditor.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 924 Setup1.exe 1404 DpEditor.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\affair1\Setup.exe 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe File opened for modification C:\Program Files (x86)\affair1\Setup.exe 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe File created C:\Program Files (x86)\affair1\Setup1.exe 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe File opened for modification C:\Program Files (x86)\affair1\Setup1.exe 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe File opened for modification C:\Program Files (x86)\affair1 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe File created C:\Program Files (x86)\affair1\__tmp_rar_sfx_access_check_259398290 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe File created C:\Program Files (x86)\affair1\KMSpico.exe 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe File opened for modification C:\Program Files (x86)\affair1\KMSpico.exe 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1488 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1404 DpEditor.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 924 Setup1.exe 1404 DpEditor.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1552 KMSpico.tmp -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1156 wrote to memory of 464 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 27 PID 1156 wrote to memory of 464 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 27 PID 1156 wrote to memory of 464 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 27 PID 1156 wrote to memory of 464 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 27 PID 1156 wrote to memory of 464 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 27 PID 1156 wrote to memory of 464 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 27 PID 1156 wrote to memory of 464 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 27 PID 1156 wrote to memory of 924 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 28 PID 1156 wrote to memory of 924 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 28 PID 1156 wrote to memory of 924 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 28 PID 1156 wrote to memory of 924 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 28 PID 1156 wrote to memory of 924 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 28 PID 1156 wrote to memory of 924 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 28 PID 1156 wrote to memory of 924 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 28 PID 1156 wrote to memory of 1688 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 29 PID 1156 wrote to memory of 1688 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 29 PID 1156 wrote to memory of 1688 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 29 PID 1156 wrote to memory of 1688 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 29 PID 1156 wrote to memory of 1688 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 29 PID 1156 wrote to memory of 1688 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 29 PID 1156 wrote to memory of 1688 1156 3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe 29 PID 1688 wrote to memory of 1552 1688 KMSpico.exe 30 PID 1688 wrote to memory of 1552 1688 KMSpico.exe 30 PID 1688 wrote to memory of 1552 1688 KMSpico.exe 30 PID 1688 wrote to memory of 1552 1688 KMSpico.exe 30 PID 1688 wrote to memory of 1552 1688 KMSpico.exe 30 PID 1688 wrote to memory of 1552 1688 KMSpico.exe 30 PID 1688 wrote to memory of 1552 1688 KMSpico.exe 30 PID 464 wrote to memory of 1112 464 Setup.exe 31 PID 464 wrote to memory of 1112 464 Setup.exe 31 PID 464 wrote to memory of 1112 464 Setup.exe 31 PID 464 wrote to memory of 1112 464 Setup.exe 31 PID 1112 wrote to memory of 1488 1112 cmd.exe 33 PID 1112 wrote to memory of 1488 1112 cmd.exe 33 PID 1112 wrote to memory of 1488 1112 cmd.exe 33 PID 1112 wrote to memory of 1488 1112 cmd.exe 33 PID 924 wrote to memory of 1404 924 Setup1.exe 34 PID 924 wrote to memory of 1404 924 Setup1.exe 34 PID 924 wrote to memory of 1404 924 Setup1.exe 34 PID 924 wrote to memory of 1404 924 Setup1.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe"C:\Users\Admin\AppData\Local\Temp\3adaf2bfb411db2b56601739580b8577a11089beffa33df2edbc9369c2e4faa7.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Program Files (x86)\affair1\Setup.exe"C:\Program Files (x86)\affair1\Setup.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\vHpOavYo & timeout 4 & del /f /q "C:\Program Files (x86)\affair1\Setup.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\timeout.exetimeout 44⤵
- Delays execution with timeout.exe
PID:1488
-
-
-
-
C:\Program Files (x86)\affair1\Setup1.exe"C:\Program Files (x86)\affair1\Setup1.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:1404
-
-
-
C:\Program Files (x86)\affair1\KMSpico.exe"C:\Program Files (x86)\affair1\KMSpico.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\is-1L5TB.tmp\KMSpico.tmp"C:\Users\Admin\AppData\Local\Temp\is-1L5TB.tmp\KMSpico.tmp" /SL5="$80150,2952592,69120,C:\Program Files (x86)\affair1\KMSpico.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1552
-
-