Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
10/03/2022, 02:29
Static task
static1
Behavioral task
behavioral1
Sample
6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe
Resource
win10v2004-en-20220113
General
-
Target
6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe
-
Size
790KB
-
MD5
fb3b1255373cbb400b23242db5245398
-
SHA1
e53bf5c7e20363d2e5217fe72e3356372c550935
-
SHA256
6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e
-
SHA512
e4a5832621897087d1e9d6a83bc9b725b80fce22bcbf70d383e7a19388aa3b661d77ea416e3e71a1d3fe70fe2565d6991d6807c2e180e9aca8b40f71cc4e06be
Malware Config
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/files/0x000800000001e7ad-130.dat MailPassView behavioral2/files/0x000800000001e7ad-131.dat MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/files/0x000800000001e7ad-130.dat WebBrowserPassView behavioral2/files/0x000800000001e7ad-131.dat WebBrowserPassView -
Nirsoft 2 IoCs
resource yara_rule behavioral2/files/0x000800000001e7ad-130.dat Nirsoft behavioral2/files/0x000800000001e7ad-131.dat Nirsoft -
Executes dropped EXE 1 IoCs
pid Process 4720 presentacion de proyecto.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1996 wrote to memory of 4720 1996 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 84 PID 1996 wrote to memory of 4720 1996 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 84 PID 1996 wrote to memory of 4720 1996 6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe 84 PID 4720 wrote to memory of 2776 4720 presentacion de proyecto.exe 86 PID 4720 wrote to memory of 2776 4720 presentacion de proyecto.exe 86 PID 4720 wrote to memory of 2776 4720 presentacion de proyecto.exe 86 PID 2776 wrote to memory of 5080 2776 fondue.exe 87 PID 2776 wrote to memory of 5080 2776 fondue.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe"C:\Users\Admin\AppData\Local\Temp\6d51784aeffbe05410d9511802b2da247a5d3bacca27429b75578b35e9f9252e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\presentacion de proyecto.exe"C:\Users\Admin\AppData\Local\Temp\presentacion de proyecto.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll3⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\system32\FonDUE.EXE"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll4⤵PID:5080
-
-
-