Analysis
- max time kernel
119s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
21/03/2022, 04:47
General
- Target ef5ab0d2ffedf54fdf3e1a24542b6361.exe
- Size 403KB
- Sample220321-fejbmshchr
- SHA256 2f7c261dd0a4f7f00b34b09fc1a35e729596a38bc80c6c54467de0dedb3c23db
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 3 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef5ab0d2ffedf54fdf3e1a24542b6361.exe"C:\Users\Admin\AppData\Local\Temp\ef5ab0d2ffedf54fdf3e1a24542b6361.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sys64.exe"C:\Users\Admin\AppData\Local\Temp\sys64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 5323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 5883⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 14922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 456 -ip 4561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3108 -ip 31081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3108 -ip 31081⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/456-150-0x0000000005F90000-0x0000000005FAE000-memory.dmp
memory/456-151-0x0000000006010000-0x0000000006076000-memory.dmp
memory/456-139-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/456-141-0x0000000004D43000-0x0000000004D44000-memory.dmp
memory/456-142-0x0000000004D50000-0x00000000052F4000-memory.dmp
memory/456-143-0x0000000005300000-0x0000000005918000-memory.dmp
memory/456-144-0x0000000004CC0000-0x0000000004CD2000-memory.dmp
memory/456-145-0x0000000005920000-0x0000000005A2A000-memory.dmp
memory/456-146-0x0000000004D44000-0x0000000004D46000-memory.dmp
memory/456-147-0x0000000005A30000-0x0000000005A6C000-memory.dmp
memory/456-148-0x0000000005D00000-0x0000000005D76000-memory.dmp
memory/456-149-0x0000000005DF0000-0x0000000005E82000-memory.dmp
memory/456-134-0x00000000006EE000-0x000000000071A000-memory.dmp
memory/456-140-0x0000000004D42000-0x0000000004D43000-memory.dmp
memory/456-152-0x00000000069B0000-0x0000000006A00000-memory.dmp
memory/456-153-0x0000000008880000-0x0000000008A42000-memory.dmp
memory/456-154-0x0000000008A70000-0x0000000008F9C000-memory.dmp
memory/456-138-0x0000000074970000-0x0000000075120000-memory.dmp
memory/456-137-0x0000000000400000-0x0000000000490000-memory.dmp
memory/456-135-0x00000000006EE000-0x000000000071A000-memory.dmp
memory/456-136-0x0000000000660000-0x000000000069A000-memory.dmp
memory/1124-163-0x000000000056C000-0x000000000057D000-memory.dmp
memory/1124-164-0x000000000056C000-0x000000000057D000-memory.dmp
memory/1124-165-0x0000000000400000-0x0000000000476000-memory.dmp
memory/3108-158-0x00000000006AD000-0x00000000006BE000-memory.dmp
memory/3108-160-0x0000000000400000-0x0000000000476000-memory.dmp
memory/3108-159-0x00000000004F0000-0x00000000004F4000-memory.dmp
memory/3108-157-0x00000000006AD000-0x00000000006BE000-memory.dmp