Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12/02/2022, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe
Resource
win7-en-20211208
General
-
Target
1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe
-
Size
303KB
-
MD5
e16669e45db7f6e0300b6cbbd042f033
-
SHA1
bfcc111f6117fd5d232a3337870ddd3b5344b8fd
-
SHA256
1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1
-
SHA512
7057857d5acf5d25abbc0f0e8bb0406ca10ee4d6b0402f44c4202122dea9042b57e12628551111f3fb7c5528bbcac629307d53809dcc97d347182e3f20c4a325
Malware Config
Extracted
cryptbot
sezylf12.top
morasx01.top
-
payload_url
http://ekuhik11.top/download.php?file=maseru.exe
Signatures
-
Deletes itself 1 IoCs
pid Process 268 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1156 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1776 wrote to memory of 268 1776 1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe 27 PID 1776 wrote to memory of 268 1776 1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe 27 PID 1776 wrote to memory of 268 1776 1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe 27 PID 1776 wrote to memory of 268 1776 1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe 27 PID 268 wrote to memory of 1156 268 cmd.exe 29 PID 268 wrote to memory of 1156 268 cmd.exe 29 PID 268 wrote to memory of 1156 268 cmd.exe 29 PID 268 wrote to memory of 1156 268 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe"C:\Users\Admin\AppData\Local\Temp\1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\VrBwXnOidVMER & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1ecf062e57ac7a546ca661761a16553a3f730b9c8477c92c317614909b1750c1.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
PID:1156
-
-