27331403cd4e737d09c723eaa8ad57607f4a243a1fcde752443af581b9141092

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
11-04-2022 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

order.exe
Size

242KB
MD5

1fca4a7a2a1bc5631ae3bed8065a9167
SHA1

631a8a37179b57365515e1b4741305d75928342e
SHA256

27331403cd4e737d09c723eaa8ad57607f4a243a1fcde752443af581b9141092
SHA512

ac4bc3e02782b8ac894caa2eb536eb193e460b011bdf4926649ac4416bbf96642a7aeaa0f60a5e739ea5d7553e411e8674f4399b5a6f0443070fe963ec8739a0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ceozrdkqb.exe

pid process

5008 ceozrdkqb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
5008	ceozrdkqb.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

order.execeozrdkqb.exe

description	pid	process	target process
PID 3700 wrote to memory of 5008	3700	order.exe	ceozrdkqb.exe
PID 3700 wrote to memory of 5008	3700	order.exe	ceozrdkqb.exe
PID 3700 wrote to memory of 5008	3700	order.exe	ceozrdkqb.exe
PID 5008 wrote to memory of 916	5008	ceozrdkqb.exe	ceozrdkqb.exe
PID 5008 wrote to memory of 916	5008	ceozrdkqb.exe	ceozrdkqb.exe
PID 5008 wrote to memory of 916	5008	ceozrdkqb.exe	ceozrdkqb.exe

C:\Users\Admin\AppData\Local\Temp\order.exe
"C:\Users\Admin\AppData\Local\Temp\order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe C:\Users\Admin\AppData\Local\Temp\mjxuvurepn
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008

C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe C:\Users\Admin\AppData\Local\Temp\mjxuvurepn
3⤵
PID:916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
Filesize
6KB

MD5
28692b8f1f61c582b540a086820097e9

SHA1
a57f8bf69b2c89947d91b3eb968e4925b447b273

SHA256
7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

SHA512
29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
Filesize
6KB

MD5
28692b8f1f61c582b540a086820097e9

SHA1
a57f8bf69b2c89947d91b3eb968e4925b447b273

SHA256
7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

SHA512
29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\mjxuvurepn
Filesize
4KB

MD5
9bac10f869bf8307d17de84fbb4d2393

SHA1
90af62da1c66391e0267b984a9cc92268e9cafec

SHA256
7cbb56af0e0ffb9b752368cbc204fe48a197d2c5df76fb30b09e5b9110d50d13

SHA512
2f047b48e736f3fc4ea66952866c1854bb765ef4c8e34321b0c230c70cb40fd948d5b094101586dec051a7c47ec0e3dfbd9a593d1a857e24815eab51f7ecee17

Download Submit
C:\Users\Admin\AppData\Local\Temp\t5jmbsy9kwg1m2u7ebq
Filesize
212KB

MD5
562c6825bc59812dfe147ff9d86ef126

SHA1
b6e7f2ebe369cef46c22c5990a2d5c78b2d17a07

SHA256
88b6b55757f0195147295c30faff512bf31a80ec2a83fff86c43d4cfd97a2da8

SHA512
9bab1f20f75310be1d2b28ccb492095e481cb7627dd002857beb7c87071ab11d47b159ee45e85049b3e9328bdd1a9e34f56a7dfa22e3fcaadbffe5c473f74483

Download Submit
memory/916-129-0x0000000000000000-mapping.dmp

Download
memory/5008-124-0x0000000000000000-mapping.dmp

Download