Analysis
-
max time kernel
185s -
max time network
223s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
19-02-2022 16:59
Static task
static1
Behavioral task
behavioral1
Sample
ccd56bca846828d16b951b099f55ae7c.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
ccd56bca846828d16b951b099f55ae7c.exe
-
Size
117.7MB
-
MD5
ccd56bca846828d16b951b099f55ae7c
-
SHA1
37641c823fc68d6e22542107a58c28247763c12a
-
SHA256
4c88894f3db3123130bf766ea024aa8baba4e9e1bd36d6509f61477e9e9bd345
-
SHA512
25395603082a94fc29c8272ee1e6abb1a602b3a81080aa2012b65623b0b46e174bc984dd3484b80d56ae770943ee41c76762c060ca93234eefd9fa24f01f843c
Malware Config
Signatures
-
Babadeda Crypter 1 IoCs
resource yara_rule behavioral2/memory/3348-178-0x0000000007CC0000-0x000000000CDC0000-memory.dmp family_babadeda -
Executes dropped EXE 1 IoCs
pid Process 3348 iisexpress.exe -
Loads dropped DLL 59 IoCs
pid Process 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe 3348 iisexpress.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ccd56bca846828d16b951b099f55ae7c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ccd56bca846828d16b951b099f55ae7c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ccd56bca846828d16b951b099f55ae7c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ccd56bca846828d16b951b099f55ae7c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5072 ccd56bca846828d16b951b099f55ae7c.exe 5072 ccd56bca846828d16b951b099f55ae7c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3348 iisexpress.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5072 wrote to memory of 3348 5072 ccd56bca846828d16b951b099f55ae7c.exe 71 PID 5072 wrote to memory of 3348 5072 ccd56bca846828d16b951b099f55ae7c.exe 71 PID 5072 wrote to memory of 3348 5072 ccd56bca846828d16b951b099f55ae7c.exe 71 PID 5072 wrote to memory of 3348 5072 ccd56bca846828d16b951b099f55ae7c.exe 71 PID 5072 wrote to memory of 3348 5072 ccd56bca846828d16b951b099f55ae7c.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccd56bca846828d16b951b099f55ae7c.exe"C:\Users\Admin\AppData\Local\Temp\ccd56bca846828d16b951b099f55ae7c.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Roaming\Audio Network Controller\iisexpress.exe"C:\Users\Admin\AppData\Roaming\Audio Network Controller\iisexpress.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3348
-