General
Target

Dota2mode.exe

Filesize

3MB

Completed

20-05-2022 05:40

Task

behavioral1

Score
8/10
MD5

888d36190614310fbfc16548f3568e84

SHA1

238d4bc0cdc004c1c2be109058375e85f6342fc8

SHA256

d90639401e952a40009d20a954359d899c318c442d03b43f2a81b7b3fc00dd92

SHA512

23852fddcbdc526bfeebd7fad33715553e155c3d16a9ae67b314da0f4678ae5fe761c6fa9894be3fe43b84666db29e08f7d77cdce5b27944e33cab3f53ab39f9

Malware Config
Signatures 8

Filter: none

Discovery
  • Executes dropped EXE
    Rar.exemonvuibk.exeRar.exe

    Reported IOCs

    pidprocess
    932Rar.exe
    824monvuibk.exe
    1520Rar.exe
  • Loads dropped DLL
    cmd.exemonvuibk.execmd.exe

    Reported IOCs

    pidprocess
    104cmd.exe
    104cmd.exe
    104cmd.exe
    824monvuibk.exe
    1736cmd.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Delays execution with timeout.exe
    timeout.exetimeout.exe

    Tags

    Reported IOCs

    pidprocess
    1352timeout.exe
    364timeout.exe
  • Kills process with taskkill
    taskkill.exetaskkill.exetaskkill.exe

    Tags

    Reported IOCs

    pidprocess
    1632taskkill.exe
    1300taskkill.exe
    1760taskkill.exe
  • Suspicious behavior: EnumeratesProcesses
    monvuibk.exe

    Reported IOCs

    pidprocess
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
    824monvuibk.exe
  • Suspicious use of AdjustPrivilegeToken
    taskkill.exetaskkill.exetaskkill.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1632taskkill.exe
    Token: SeDebugPrivilege1300taskkill.exe
    Token: SeDebugPrivilege1760taskkill.exe
  • Suspicious use of WriteProcessMemory
    Dota2mode.exeWScript.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 904 wrote to memory of 608904Dota2mode.exeWScript.exe
    PID 904 wrote to memory of 608904Dota2mode.exeWScript.exe
    PID 904 wrote to memory of 608904Dota2mode.exeWScript.exe
    PID 904 wrote to memory of 608904Dota2mode.exeWScript.exe
    PID 904 wrote to memory of 608904Dota2mode.exeWScript.exe
    PID 904 wrote to memory of 608904Dota2mode.exeWScript.exe
    PID 904 wrote to memory of 608904Dota2mode.exeWScript.exe
    PID 608 wrote to memory of 104608WScript.execmd.exe
    PID 608 wrote to memory of 104608WScript.execmd.exe
    PID 608 wrote to memory of 104608WScript.execmd.exe
    PID 608 wrote to memory of 104608WScript.execmd.exe
    PID 608 wrote to memory of 104608WScript.execmd.exe
    PID 608 wrote to memory of 104608WScript.execmd.exe
    PID 608 wrote to memory of 104608WScript.execmd.exe
    PID 104 wrote to memory of 1632104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1632104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1632104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1632104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1632104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1632104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1632104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1300104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1300104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1300104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1300104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1300104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1300104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1300104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1352104cmd.exetimeout.exe
    PID 104 wrote to memory of 1352104cmd.exetimeout.exe
    PID 104 wrote to memory of 1352104cmd.exetimeout.exe
    PID 104 wrote to memory of 1352104cmd.exetimeout.exe
    PID 104 wrote to memory of 1352104cmd.exetimeout.exe
    PID 104 wrote to memory of 1352104cmd.exetimeout.exe
    PID 104 wrote to memory of 1352104cmd.exetimeout.exe
    PID 104 wrote to memory of 1664104cmd.exechcp.com
    PID 104 wrote to memory of 1664104cmd.exechcp.com
    PID 104 wrote to memory of 1664104cmd.exechcp.com
    PID 104 wrote to memory of 1664104cmd.exechcp.com
    PID 104 wrote to memory of 1664104cmd.exechcp.com
    PID 104 wrote to memory of 1664104cmd.exechcp.com
    PID 104 wrote to memory of 1664104cmd.exechcp.com
    PID 104 wrote to memory of 932104cmd.exeRar.exe
    PID 104 wrote to memory of 932104cmd.exeRar.exe
    PID 104 wrote to memory of 932104cmd.exeRar.exe
    PID 104 wrote to memory of 932104cmd.exeRar.exe
    PID 104 wrote to memory of 932104cmd.exeRar.exe
    PID 104 wrote to memory of 932104cmd.exeRar.exe
    PID 104 wrote to memory of 932104cmd.exeRar.exe
    PID 104 wrote to memory of 1760104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1760104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1760104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1760104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1760104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1760104cmd.exetaskkill.exe
    PID 104 wrote to memory of 1760104cmd.exetaskkill.exe
    PID 104 wrote to memory of 824104cmd.exemonvuibk.exe
    PID 104 wrote to memory of 824104cmd.exemonvuibk.exe
    PID 104 wrote to memory of 824104cmd.exemonvuibk.exe
    PID 104 wrote to memory of 824104cmd.exemonvuibk.exe
    PID 104 wrote to memory of 824104cmd.exemonvuibk.exe
    PID 104 wrote to memory of 824104cmd.exemonvuibk.exe
    PID 104 wrote to memory of 824104cmd.exemonvuibk.exe
    PID 104 wrote to memory of 364104cmd.exetimeout.exe
Processes 14
  • C:\Users\Admin\AppData\Local\Temp\Dota2mode.exe
    "C:\Users\Admin\AppData\Local\Temp\Dota2mode.exe"
    Suspicious use of WriteProcessMemory
    PID:904
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\sunshiqn\run.vbs"
      Suspicious use of WriteProcessMemory
      PID:608
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\sunshiqn\pause.bat" "
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        PID:104
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rar.exe
          Kills process with taskkill
          Suspicious use of AdjustPrivilegeToken
          PID:1632
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rar.exe
          Kills process with taskkill
          Suspicious use of AdjustPrivilegeToken
          PID:1300
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          Delays execution with timeout.exe
          PID:1352
        • C:\Windows\SysWOW64\chcp.com
          chcp 1251
          PID:1664
        • C:\sunshiqn\Rar.exe
          "Rar.exe" e -p555 privat.rar
          Executes dropped EXE
          PID:932
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im rar.exe
          Kills process with taskkill
          Suspicious use of AdjustPrivilegeToken
          PID:1760
        • C:\sunshiqn\monvuibk.exe
          monvuibk.exe
          Executes dropped EXE
          Loads dropped DLL
          Suspicious behavior: EnumeratesProcesses
          PID:824
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\xnojklgq\omen.bat" "
            Loads dropped DLL
            PID:1736
            • C:\Windows\SysWOW64\chcp.com
              chcp 1251
              PID:1488
            • C:\xnojklgq\Rar.exe
              "Rar.exe" c -zinfo.txt "plus.exe"
              Executes dropped EXE
              PID:1520
        • C:\Windows\SysWOW64\timeout.exe
          timeout 2
          Delays execution with timeout.exe
          PID:364
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\sunshiqn\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • C:\sunshiqn\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • C:\sunshiqn\monvuibk.exe

                          MD5

                          5a5db532785179ed05b8a80187d7ee21

                          SHA1

                          e42a3a40e836b691c2aa9dbe9600da17c8c75763

                          SHA256

                          43d61d6b22303523a18c79162c58c15f108635a6b9bbff1a3331b74624467593

                          SHA512

                          4e45569289f3dbe5abd7c2f4303e2af0facdf239ec1effd2d15fac01f129bcd44ece0b389892ad70a42d0dd511e156adb5ce98176158c0ea42b4b0fefa51138b

                        • C:\sunshiqn\monvuibk.exe

                          MD5

                          5a5db532785179ed05b8a80187d7ee21

                          SHA1

                          e42a3a40e836b691c2aa9dbe9600da17c8c75763

                          SHA256

                          43d61d6b22303523a18c79162c58c15f108635a6b9bbff1a3331b74624467593

                          SHA512

                          4e45569289f3dbe5abd7c2f4303e2af0facdf239ec1effd2d15fac01f129bcd44ece0b389892ad70a42d0dd511e156adb5ce98176158c0ea42b4b0fefa51138b

                        • C:\sunshiqn\pause.bat

                          MD5

                          fb085f47185862061fa2adb5acc58171

                          SHA1

                          5f91cf2e8bc109e20dbe97ab91d0b047a727e93b

                          SHA256

                          fec96179e59437ede713340e5686b681c107a0363e79c5c24045887f5e7d3e1b

                          SHA512

                          a2ac14d7e67fa5d13312141b76fbc11cd373dfb1499b7d575c80e4409334a4bb28523d31044003fd907e5e52ac5e5cc45377551b1d3b704b94b2de7de892e76e

                        • C:\sunshiqn\privat.rar

                          MD5

                          bcd1d52c65ff0c640681ef7f4b4dd701

                          SHA1

                          b3a364dda02cd50ebb7990b2bfee1779a001bd95

                          SHA256

                          c54c442cfc5b905a337c740e1008ada67158e22c1b780d39e0e7c5e90ab82750

                          SHA512

                          bd9f2033a337acfed85e500588814530f81ef299a241998ae20d4518b01d9094e7ec65f7da2bfbc6328b9a89fd90cdc9233e575274efd4db04269baf035526b8

                        • C:\sunshiqn\run.vbs

                          MD5

                          6a5f5a48072a1adae96d2bd88848dcff

                          SHA1

                          b381fa864db6c521cbf1133a68acf1db4baa7005

                          SHA256

                          c7758bb2fdf207306a5b83c9916bfffcc5e85efe14c8f00d18e2b6639b9780fe

                          SHA512

                          d11101b11a95d39a2b23411955e869f92451e1613b150c15d953cccf0f741fb6c3cf082124af8b67d4eb40feb112e1167a1e25bdeab9e433af3ccc5384ccb90c

                        • C:\xnojklgq\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • C:\xnojklgq\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • C:\xnojklgq\info.txt

                          MD5

                          88cebd7e2150d2c3b0c6bff92766cebe

                          SHA1

                          a2f955ec6dca14621fa7242b3c7cec77fa349f21

                          SHA256

                          5ff39948360d11a40eb8fdcfdd0e31da86bb4018fad97745f570f9bebd159d38

                          SHA512

                          e0d2690e5ccaaad279ebb73c2ffc7ee3ca6fe0cbf3af3974df1124eb71fd00906a71819675a258a65411130cf0778ae7f5554d0b1b9be2a4dfd4c486a74597be

                        • C:\xnojklgq\omen.bat

                          MD5

                          a15b61671e902fe28fb1bf7e459a7bdd

                          SHA1

                          694d542af6834fa4cbc81cc3b3a8a99d61378f5e

                          SHA256

                          d763ef51ee4520819f8021ebb138578ba3261aa8db5fcec7c69382cca95ff75f

                          SHA512

                          653ec95af8f6f73538b0cb8d0fe903267e56b1f1a7d810bff1f4dd5adf675ae2f5a55260b0bc41295b60052fe056b1acfa00c2a07121dd387eb7719997fa15f6

                        • C:\xnojklgq\plus.exe

                          MD5

                          ca106b2dd914c5f5b7c0b30e503e35d9

                          SHA1

                          0c072402d244612f45f9901a3a22726226a64e29

                          SHA256

                          b300747328bd15f160c5bc063e80a961ebf56f3efe2c14da0c51dcbb38b0a55b

                          SHA512

                          ee4afcfe7763c66d8a9f2eafa0bd889b0aa86ebaad18d817f23dc6240a214425837dc593dbed971a07a51455ca6911a5f777912687a56e0d8446db0a31664c0a

                        • \sunshiqn\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • \sunshiqn\monvuibk.exe

                          MD5

                          5a5db532785179ed05b8a80187d7ee21

                          SHA1

                          e42a3a40e836b691c2aa9dbe9600da17c8c75763

                          SHA256

                          43d61d6b22303523a18c79162c58c15f108635a6b9bbff1a3331b74624467593

                          SHA512

                          4e45569289f3dbe5abd7c2f4303e2af0facdf239ec1effd2d15fac01f129bcd44ece0b389892ad70a42d0dd511e156adb5ce98176158c0ea42b4b0fefa51138b

                        • \sunshiqn\monvuibk.exe

                          MD5

                          5a5db532785179ed05b8a80187d7ee21

                          SHA1

                          e42a3a40e836b691c2aa9dbe9600da17c8c75763

                          SHA256

                          43d61d6b22303523a18c79162c58c15f108635a6b9bbff1a3331b74624467593

                          SHA512

                          4e45569289f3dbe5abd7c2f4303e2af0facdf239ec1effd2d15fac01f129bcd44ece0b389892ad70a42d0dd511e156adb5ce98176158c0ea42b4b0fefa51138b

                        • \sunshiqn\monvuibk.exe

                          MD5

                          5a5db532785179ed05b8a80187d7ee21

                          SHA1

                          e42a3a40e836b691c2aa9dbe9600da17c8c75763

                          SHA256

                          43d61d6b22303523a18c79162c58c15f108635a6b9bbff1a3331b74624467593

                          SHA512

                          4e45569289f3dbe5abd7c2f4303e2af0facdf239ec1effd2d15fac01f129bcd44ece0b389892ad70a42d0dd511e156adb5ce98176158c0ea42b4b0fefa51138b

                        • \xnojklgq\Rar.exe

                          MD5

                          2e86a9862257a0cf723ceef3868a1a12

                          SHA1

                          a4324281823f0800132bf13f5ad3860e6b5532c6

                          SHA256

                          2356220cfa9159b463d762e2833f647a04fa58b4c627fcb4fb1773d199656ab8

                          SHA512

                          3a8e0389637fc8a3f8bab130326fe091ead8c0575a1a3861622466d4e3c37818c928bc74af4d14b5bb3080dfae46e41fee2c362a7093b5aa3b9df39110c8e9de

                        • memory/104-59-0x0000000000000000-mapping.dmp

                        • memory/364-83-0x0000000000000000-mapping.dmp

                        • memory/608-55-0x0000000000000000-mapping.dmp

                        • memory/824-80-0x0000000000000000-mapping.dmp

                        • memory/904-54-0x00000000751C1000-0x00000000751C3000-memory.dmp

                        • memory/932-71-0x0000000000000000-mapping.dmp

                        • memory/1300-63-0x0000000000000000-mapping.dmp

                        • memory/1352-65-0x0000000000000000-mapping.dmp

                        • memory/1488-89-0x0000000000000000-mapping.dmp

                        • memory/1520-93-0x0000000000000000-mapping.dmp

                        • memory/1632-61-0x0000000000000000-mapping.dmp

                        • memory/1664-67-0x0000000000000000-mapping.dmp

                        • memory/1736-86-0x0000000000000000-mapping.dmp

                        • memory/1760-75-0x0000000000000000-mapping.dmp