a26a8103df2d4fd152def868cfead5e1e2c9b333d0d0110cee02c06a98f1c188

Resubmissions

07/07/2022, 09:56

220707-lys8vaeaa210

08/07/2020, 16:57

200708-h82csp5pr27

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
07/07/2022, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
Size 88KB
Sample220707-lys8vaeaa2
SHA256 a26a8103df2d4fd152def868cfead5e1e2c9b333d0d0110cee02c06a98f1c188
MD5 ba7cce6da078c2825b05ee305773edb6
SHA1 3f823143e545b627759b644fc2d570b08e418ca7
SHA512 0e725d372ec4c095d76dbc5875105ede1ceeb2ac62ec20c6d53d6ef21e929d63b785d30fc09d359b635de96b3b67f1f361a105f733dfa06c6dacad40849152d7
MD5 SHA1 SHA512

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE GoldenSpy Domain Observed
suricata: ET MALWARE GoldenSpy Domain Observed
suricata

Deletes itself 1 IoCs

pid	Process
1964	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1236	tasklist.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1616	taskkill.exe
1720	taskkill.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	tasklist.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	1720	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 860	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	27
PID 908 wrote to memory of 860	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	27
PID 908 wrote to memory of 860	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	27
PID 908 wrote to memory of 860	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	27
PID 860 wrote to memory of 1236	860	cmd.exe	29
PID 860 wrote to memory of 1236	860	cmd.exe	29
PID 860 wrote to memory of 1236	860	cmd.exe	29
PID 860 wrote to memory of 1236	860	cmd.exe	29
PID 908 wrote to memory of 1616	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	31
PID 908 wrote to memory of 1616	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	31
PID 908 wrote to memory of 1616	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	31
PID 908 wrote to memory of 1616	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	31
PID 908 wrote to memory of 1720	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	33
PID 908 wrote to memory of 1720	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	33
PID 908 wrote to memory of 1720	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	33
PID 908 wrote to memory of 1720	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	33
PID 908 wrote to memory of 544	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	37
PID 908 wrote to memory of 544	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	37
PID 908 wrote to memory of 544	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	37
PID 908 wrote to memory of 544	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	37
PID 908 wrote to memory of 1712	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	39
PID 908 wrote to memory of 1712	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	39
PID 908 wrote to memory of 1712	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	39
PID 908 wrote to memory of 1712	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	39
PID 908 wrote to memory of 1964	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	40
PID 908 wrote to memory of 1964	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	40
PID 908 wrote to memory of 1964	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	40
PID 908 wrote to memory of 1964	908	SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe	40

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist > "C:\Users\Admin\AppData\Local\Temp\process.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM svmm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM svm.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe"
  2⤵
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c RMDIR /S /Q "C:\Program Files (x86)\svm"
  2⤵
  PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.DH_QoI4NgoT.16481.exe"
  2⤵
  - Deletes itself
  PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

process.txt

Path C:\Users\Admin\AppData\Local\Temp\process.txt
Size 2KB
SHA256 6d8212f6a94529e5cfc149a3922a7c9aa6d056ee9bba42a74ff28f746e1ba315
MD5 b3f7a3dae9b1157928c7fead89bc70d7
SHA1 7a800116f39d5fae81b46b00fd04dabb9b19c834
SHA512 6c6e773be59bb625f8811bf161e52863e31622e309c9b3284be85318347551625ef0953475fe957bc9909add2348df1df0887266eb3e208cdc4e3104725579fc
MD5 SHA1 SHA512

Submit Download

memory/908-54-0x0000000075CD1000-0x0000000075CD3000-memory.dmp

Download