Overview

overview

10

Static

static

aa2c0a9e34...d5.exe

windows7_x64

10

aa2c0a9e34...d5.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    30-04-2022 21:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5.exe

  • Size

    160KB

  • MD5

    8f70a0f45532261cb4df2800b141551d

  • SHA1

    521bbc045dfb7bf9fca55058ed2fc03d86cf8d00

  • SHA256

    aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5

  • SHA512

    3ea19ee472f3c7f9b7452fb4769fc3cc7591acff0f155889d08dadbd1f6ae289eaa310e220279318ac1536f99ea88e43ff75836aee47f3b4fbe8aa477cb9d099

Score
10/10
evasionspywarestealersuricatatrojanvmprotect

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    suricata
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5.exe
    "C:\Users\Admin\AppData\Local\Temp\aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Users\Admin\Pictures\Adobe Films\dTw7bWV4FbM6rRFVyc70AjbL.exe
      "C:\Users\Admin\Pictures\Adobe Films\dTw7bWV4FbM6rRFVyc70AjbL.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4308
    • C:\Users\Admin\Pictures\Adobe Films\JziJnZN0J69Fa862aaoLglhY.exe
      "C:\Users\Admin\Pictures\Adobe Films\JziJnZN0J69Fa862aaoLglhY.exe"
      2⤵
      • Executes dropped EXE
      PID:116
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 116 -s 716
        3⤵
        • Program crash
        PID:3452
    • C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe
      "C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe
        "C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe" -u
        3⤵
        • Executes dropped EXE
        PID:1140
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 444 -p 116 -ip 116
    1⤵
      PID:3464
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
      1⤵
      • Process spawned unexpected child process
      PID:3572

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\sqlite.dll
      Filesize

      4KB

      MD5

      0a525c03073b1e847112516645afb12a

      SHA1

      4c5918b8c22840c4cf7cc1c295c9bf65ae735186

      SHA256

      933f5238b8923fa533d794b844223c45989aa310ea3822c495f78c4b7255bc82

      SHA512

      23768e8fbecc3b7bb58463621083e02aa51b2ab11a0af196b975aed47d6b4d8a49fa11d4588d35c160589155f1870ed5b8707e7d97b380f3d46e9076aa76fed2

      Download Submit

    • C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe
      Filesize

      124KB

      MD5

      2e1ed9a6411f5457e15eb9962d9badc3

      SHA1

      bf803cfd24fe8e890e2bf420a9e27567b878f000

      SHA256

      97ead2057976cc989c024fa9ad761549fa57e53b16ca38aeecf3aa70da77c0ea

      SHA512

      b9d3be71b33b9eea68dd7274e7cb587fa5d59c073f134db147a7d74c357d8f5037a75cfa086c838129ec88a3961061f1e8d95ba00d63ceca5db79674df8cf917

      Download Submit

    • C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe
      Filesize

      124KB

      MD5

      2e1ed9a6411f5457e15eb9962d9badc3

      SHA1

      bf803cfd24fe8e890e2bf420a9e27567b878f000

      SHA256

      97ead2057976cc989c024fa9ad761549fa57e53b16ca38aeecf3aa70da77c0ea

      SHA512

      b9d3be71b33b9eea68dd7274e7cb587fa5d59c073f134db147a7d74c357d8f5037a75cfa086c838129ec88a3961061f1e8d95ba00d63ceca5db79674df8cf917

      Download Submit

    • C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe
      Filesize

      124KB

      MD5

      2e1ed9a6411f5457e15eb9962d9badc3

      SHA1

      bf803cfd24fe8e890e2bf420a9e27567b878f000

      SHA256

      97ead2057976cc989c024fa9ad761549fa57e53b16ca38aeecf3aa70da77c0ea

      SHA512

      b9d3be71b33b9eea68dd7274e7cb587fa5d59c073f134db147a7d74c357d8f5037a75cfa086c838129ec88a3961061f1e8d95ba00d63ceca5db79674df8cf917

      Download Submit

    • C:\Users\Admin\Pictures\Adobe Films\JziJnZN0J69Fa862aaoLglhY.exe
      Filesize

      3.5MB

      MD5

      7cbc3a715be50a7a2ac90aa00fdda5dc

      SHA1

      c6e9102a2898b18d99e6a0defe54e5f3b2cf0474

      SHA256

      f47755c073f054a4e37db79d062ff80bcf5db3681b7f73cb17e5e7c50a9ef000

      SHA512

      772ff2c641918fa3705dac48dd43a5ba258192c15b21e9fc0ed485af4700ceb15f92d88c40498d9ce1893958cb63d42209fa901f2c6d6c09c2d40dd073ae7f9a

      Download Submit

    • C:\Users\Admin\Pictures\Adobe Films\JziJnZN0J69Fa862aaoLglhY.exe
      Filesize

      3.5MB

      MD5

      7cbc3a715be50a7a2ac90aa00fdda5dc

      SHA1

      c6e9102a2898b18d99e6a0defe54e5f3b2cf0474

      SHA256

      f47755c073f054a4e37db79d062ff80bcf5db3681b7f73cb17e5e7c50a9ef000

      SHA512

      772ff2c641918fa3705dac48dd43a5ba258192c15b21e9fc0ed485af4700ceb15f92d88c40498d9ce1893958cb63d42209fa901f2c6d6c09c2d40dd073ae7f9a

      Download Submit

    • C:\Users\Admin\Pictures\Adobe Films\dTw7bWV4FbM6rRFVyc70AjbL.exe
      Filesize

      318KB

      MD5

      3f22bd82ee1b38f439e6354c60126d6d

      SHA1

      63b57d818f86ea64ebc8566faeb0c977839defde

      SHA256

      265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

      SHA512

      b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

      Download Submit

    • C:\Users\Admin\Pictures\Adobe Films\dTw7bWV4FbM6rRFVyc70AjbL.exe
      Filesize

      318KB

      MD5

      3f22bd82ee1b38f439e6354c60126d6d

      SHA1

      63b57d818f86ea64ebc8566faeb0c977839defde

      SHA256

      265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

      SHA512

      b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

      Download Submit

    • memory/116-137-0x0000000140000000-0x0000000140604000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4188-130-0x0000000004220000-0x00000000043E0000-memory.dmp

      Filesize

      1.8MB

      Download