Analysis
-
max time kernel
4294180s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
20-03-2022 01:59
Static task
static1
Behavioral task
behavioral1
Sample
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe
Resource
win10v2004-20220310-en
General
-
Target
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe
-
Size
2.4MB
-
MD5
2ce52a25ec3c74b4a0608e8d0fdec0ff
-
SHA1
d60c64e1333c214db1b37b3d706e10bbc794c3af
-
SHA256
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3
-
SHA512
9d90b5b6b2b599b791ee938786879cd27fb491878316292fa0e15d34d62060fd717a49bcbc2aa0079d74af053cb452cb82c83f535ce8cc0e871ca1e776fa8397
Malware Config
Signatures
-
Echelon log file 1 IoCs
Detects a log file produced by Echelon.
Processes:
yara_rule echelon_log_file -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Wine d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.ipify.org 4 api.ipify.org 5 api.ipify.org 6 ip-api.com -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exedescription ioc process File opened for modification \??\PhysicalDrive0 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exepid process 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1576 1932 WerFault.exe d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exepid process 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exedescription pid process Token: SeDebugPrivilege 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exedescription pid process target process PID 1932 wrote to memory of 1576 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe WerFault.exe PID 1932 wrote to memory of 1576 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe WerFault.exe PID 1932 wrote to memory of 1576 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe WerFault.exe PID 1932 wrote to memory of 1576 1932 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe -
outlook_win_path 1 IoCs
Processes:
d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe"C:\Users\Admin\AppData\Local\Temp\d117bb94ace706283addab84a8c3fcd5b93591fc527f0664299dcefabc2a90d3.exe"1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Accesses Microsoft Outlook profiles
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 22002⤵
- Program crash
PID:1576
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1932-54-0x0000000075D31000-0x0000000075D33000-memory.dmpFilesize
8KB
-
memory/1932-56-0x0000000000D60000-0x00000000013B8000-memory.dmpFilesize
6.3MB
-
memory/1932-58-0x0000000075040000-0x000000007504B000-memory.dmpFilesize
44KB
-
memory/1932-59-0x0000000000D60000-0x00000000013B8000-memory.dmpFilesize
6.3MB
-
memory/1932-57-0x0000000077790000-0x0000000077910000-memory.dmpFilesize
1.5MB
-
memory/1932-60-0x0000000075050000-0x000000007509A000-memory.dmpFilesize
296KB
-
memory/1932-61-0x0000000074F60000-0x0000000074F69000-memory.dmpFilesize
36KB
-
memory/1932-62-0x00000000745E0000-0x0000000074CCE000-memory.dmpFilesize
6.9MB
-
memory/1932-63-0x0000000075210000-0x0000000075300000-memory.dmpFilesize
960KB
-
memory/1932-64-0x0000000075A60000-0x0000000075B2C000-memory.dmpFilesize
816KB
-
memory/1932-65-0x0000000074DE0000-0x0000000074E60000-memory.dmpFilesize
512KB
-
memory/1932-66-0x00000000758A0000-0x0000000075923000-memory.dmpFilesize
524KB
-
memory/1932-67-0x0000000073EF0000-0x00000000745DE000-memory.dmpFilesize
6.9MB
-
memory/1932-68-0x0000000074DC0000-0x0000000074DCE000-memory.dmpFilesize
56KB
-
memory/1932-69-0x0000000073EF0000-0x00000000745DE000-memory.dmpFilesize
6.9MB
-
memory/1932-70-0x0000000073EF0000-0x00000000745DE000-memory.dmpFilesize
6.9MB
-
memory/1932-71-0x0000000006000000-0x0000000006001000-memory.dmpFilesize
4KB
-
memory/1932-72-0x0000000006005000-0x0000000006016000-memory.dmpFilesize
68KB
-
memory/1932-73-0x0000000075940000-0x0000000075A5D000-memory.dmpFilesize
1.1MB
-
memory/1932-74-0x0000000073E50000-0x0000000073E67000-memory.dmpFilesize
92KB
-
memory/1932-76-0x0000000006016000-0x0000000006017000-memory.dmpFilesize
4KB
-
memory/1932-75-0x000000006EBB0000-0x000000006EC02000-memory.dmpFilesize
328KB
-
memory/1932-77-0x0000000073C50000-0x0000000073C5D000-memory.dmpFilesize
52KB
-
memory/1932-78-0x000000006EB10000-0x000000006EB68000-memory.dmpFilesize
352KB
-
memory/1932-79-0x0000000076CB0000-0x0000000076CD7000-memory.dmpFilesize
156KB
-
memory/1932-80-0x0000000006017000-0x0000000006018000-memory.dmpFilesize
4KB