3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e

General

Target

3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
Size

73KB
MD5

d7abbc6381f5a83e7e92eba71c71c42d
SHA1

53837287d01e778c5e00ca7d263e1b5a503c88c0
SHA256

3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e
SHA512

1888a5df9bffc9b5ae90284a7109d7dea7775b80a8afbf499e8075f07dcea5f0231b58fd3f4bdd1a1f19fe217551b1e3938b97423a151e4a57091453e3aa8072

Score

10^/10

persistence suricata

Malware Config

Signatures

suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata: ET MALWARE Observed GandCrab Domain (gandcrab .bit)
suricata

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\quhxhpldjda = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe"	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe

description	ioc	process
File opened (read-only)	\??\V:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\X:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\Y:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\Z:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\H:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\J:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\N:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\R:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\T:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\B:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\E:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\P:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\S:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\Q:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\U:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\W:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\A:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\F:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\I:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\O:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\G:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\K:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\L:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
File opened (read-only)	\??\M:	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe

pid	process
3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe

description	pid	process	target process
PID 3520 wrote to memory of 8	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 8	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 8	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 4148	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 4148	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 4148	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 2676	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 2676	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 2676	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 4192	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 4192	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 4192	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 3384	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 3384	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 3384	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 1816	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 1816	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 1816	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 4596	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 4596	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe
PID 3520 wrote to memory of 4596	3520	3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe
"C:\Users\Admin\AppData\Local\Temp\3f6fd6ffec1742ea53f9eb21110d899e5636127f68ab2c66c777fcdaeec6381e.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3520