Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-03-2022 00:07
General
-
Target
3e7a2442794542444ce7eb56c63340de1d92912d7d2883cc90dd3787e0d00d3c.exe
-
Size
12.4MB
-
MD5
8d7bc30e8f1256b3a1a447e6cf8de012
-
SHA1
26e266cb7f8b5dc4826d487c1e3bbfe78dfdb87b
-
SHA256
3e7a2442794542444ce7eb56c63340de1d92912d7d2883cc90dd3787e0d00d3c
-
SHA512
6e44c6f3ee7614fb286daf80d14ab16d28a5aaca6edcc8db4ca421e991cc583189419271fb23860895726bc29211c8ead4b8edae253dfddaf4493139aa71b692
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e7a2442794542444ce7eb56c63340de1d92912d7d2883cc90dd3787e0d00d3c.exe"C:\Users\Admin\AppData\Local\Temp\3e7a2442794542444ce7eb56c63340de1d92912d7d2883cc90dd3787e0d00d3c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mono-Install.exe"C:\Users\Admin\AppData\Local\Temp\Mono-Install.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 44⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
1c1818c3b332b2ef045ddb22abf1dbf9
SHA16d4bf4c4375465f6c47371ff542e9f9ed5798be6
SHA2560314a3f57a790247db452c1100695503329e5c81e93859d9126a7d2cd788214c
SHA512ca8c14d5dde9cc2641b537990ccc1d3754bf51b67c9410f0b0b8e9ef1ea9faa78807626d4d25c9e7d27700e876e389468ee57442e6f9eebfaffd111c045cc030
-
MD5
1c1818c3b332b2ef045ddb22abf1dbf9
SHA16d4bf4c4375465f6c47371ff542e9f9ed5798be6
SHA2560314a3f57a790247db452c1100695503329e5c81e93859d9126a7d2cd788214c
SHA512ca8c14d5dde9cc2641b537990ccc1d3754bf51b67c9410f0b0b8e9ef1ea9faa78807626d4d25c9e7d27700e876e389468ee57442e6f9eebfaffd111c045cc030
-
MD5
73712247036b6a24d16502c57a3e5679
SHA165ca9edadb0773fc34db7dfefe9e6416f1ac17fa
SHA2568bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0
SHA512548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de
-
MD5
96ba3f9039a185d138836138659887cb
SHA1b2de46b3863abc018265824c9089c28edebcc1a5
SHA256f4b6a78225e9703f17cead70638ad72340c8e1c1b5b59262bac17ed6ebf36b78
SHA51270bc4a06ec8d4c9e3b1d9d694bc79c3304cbe82b9ed0cb3f904ac0b8e59215cc83768c9506d19bee5d658868c3d111dfc8b160c8cf3d5d1dd6666174ba46ab72
-
MD5
96ba3f9039a185d138836138659887cb
SHA1b2de46b3863abc018265824c9089c28edebcc1a5
SHA256f4b6a78225e9703f17cead70638ad72340c8e1c1b5b59262bac17ed6ebf36b78
SHA51270bc4a06ec8d4c9e3b1d9d694bc79c3304cbe82b9ed0cb3f904ac0b8e59215cc83768c9506d19bee5d658868c3d111dfc8b160c8cf3d5d1dd6666174ba46ab72
-
Filesize
296KB
-
Filesize
7.7MB
-
Filesize
3.9MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
4KB