Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-06-2022 07:16
Static task
static1
Behavioral task
behavioral1
Sample
3f4db4050dee9f3e8bd5e5582c819cf5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3f4db4050dee9f3e8bd5e5582c819cf5.exe
Resource
win10v2004-20220414-en
General
-
Target
3f4db4050dee9f3e8bd5e5582c819cf5.exe
-
Size
2.3MB
-
MD5
3f4db4050dee9f3e8bd5e5582c819cf5
-
SHA1
9791da30a7d8e2370d035d46dc45238daaf79301
-
SHA256
8dae589a1806bcf1cf37a85cf9821a25527c4a271d8aba3c9a8f621061766840
-
SHA512
f748cd3cd36f994977010305c71e6f4eeb611240c7edcb972e29bb7c82c7067715001e492d12975c9e14d38496acb1643e75bb7703f568ab5effe53bd62227dd
Malware Config
Extracted
bitrat
1.38
37.0.11.155:4670
-
communication_password
31af2433c836721a29f5d8e94b790444
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 3f4db4050dee9f3e8bd5e5582c819cf5.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dzueh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Prrmwscy\\Dzueh.exe\"" 3f4db4050dee9f3e8bd5e5582c819cf5.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
InstallUtil.exepid process 4452 InstallUtil.exe 4452 InstallUtil.exe 4452 InstallUtil.exe 4452 InstallUtil.exe 4452 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.exedescription pid process target process PID 2384 set thread context of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1512 timeout.exe 1860 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.exepid process 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe Token: SeShutdownPrivilege 4452 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 4452 InstallUtil.exe 4452 InstallUtil.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
3f4db4050dee9f3e8bd5e5582c819cf5.execmd.execmd.exedescription pid process target process PID 2384 wrote to memory of 1172 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 2384 wrote to memory of 1172 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 2384 wrote to memory of 1172 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 1172 wrote to memory of 1512 1172 cmd.exe timeout.exe PID 1172 wrote to memory of 1512 1172 cmd.exe timeout.exe PID 1172 wrote to memory of 1512 1172 cmd.exe timeout.exe PID 2384 wrote to memory of 4352 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 2384 wrote to memory of 4352 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 2384 wrote to memory of 4352 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe cmd.exe PID 4352 wrote to memory of 1860 4352 cmd.exe timeout.exe PID 4352 wrote to memory of 1860 4352 cmd.exe timeout.exe PID 4352 wrote to memory of 1860 4352 cmd.exe timeout.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe PID 2384 wrote to memory of 4452 2384 3f4db4050dee9f3e8bd5e5582c819cf5.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f4db4050dee9f3e8bd5e5582c819cf5.exe"C:\Users\Admin\AppData\Local\Temp\3f4db4050dee9f3e8bd5e5582c819cf5.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C timeout /nobreak /t 192⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak /t 193⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 392⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 393⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1172-131-0x0000000000000000-mapping.dmp
-
memory/1512-132-0x0000000000000000-mapping.dmp
-
memory/1860-136-0x0000000000000000-mapping.dmp
-
memory/2384-130-0x0000000000E50000-0x00000000010A8000-memory.dmpFilesize
2.3MB
-
memory/2384-133-0x0000000006EF0000-0x0000000007494000-memory.dmpFilesize
5.6MB
-
memory/2384-134-0x00000000069E0000-0x0000000006A72000-memory.dmpFilesize
584KB
-
memory/4352-135-0x0000000000000000-mapping.dmp
-
memory/4452-139-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4452-137-0x0000000000000000-mapping.dmp
-
memory/4452-138-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4452-140-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4452-141-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4452-142-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/4452-143-0x0000000074C60000-0x0000000074C99000-memory.dmpFilesize
228KB
-
memory/4452-144-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4452-145-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/4452-146-0x0000000074C60000-0x0000000074C99000-memory.dmpFilesize
228KB