Analysis
-
max time kernel
70s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 06:12
Static task
static1
Behavioral task
behavioral1
Sample
950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe
Resource
win7-20220718-en
General
-
Target
950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe
-
Size
35.9MB
-
MD5
1aa9acffe0e10bbb240e0dfa07936d38
-
SHA1
f0624cc7588dd3d8cb0a5f618afa518097aabb69
-
SHA256
950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18
-
SHA512
cd89eb5ab041a81f77f015b13485010b105704fc04125177c7045c950a4c40759a1f5359ec2e1f590bb8ee493e7b7f04e84f362c232953de6bbb32a386841b55
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Decoder.exepid process 2924 Decoder.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2783062828-828903012-4218294845-1000\Control Panel\International\Geo\Nation 950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 api.ipify.org 2 api.ipify.org 6 ip-api.com 10 freegeoip.app 11 freegeoip.app -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Decoder.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Decoder.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Decoder.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1840 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exeDecoder.exepid process 2632 950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe 2632 950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe 2924 Decoder.exe 2924 Decoder.exe 2924 Decoder.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exeDecoder.exedescription pid process Token: SeDebugPrivilege 2632 950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe Token: SeDebugPrivilege 2924 Decoder.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.execmd.exedescription pid process target process PID 2632 wrote to memory of 2924 2632 950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe Decoder.exe PID 2632 wrote to memory of 2924 2632 950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe Decoder.exe PID 2632 wrote to memory of 2924 2632 950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe Decoder.exe PID 2632 wrote to memory of 2216 2632 950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe cmd.exe PID 2632 wrote to memory of 2216 2632 950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe cmd.exe PID 2216 wrote to memory of 1840 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 1840 2216 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe"C:\Users\Admin\AppData\Local\Temp\950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Decoder.exeFilesize
490KB
MD5c29c0d495ed13e703f433d53bdffdab8
SHA174ed36e6b6027b61abcfe2956670ffd9de7fd71a
SHA25620309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b
SHA512fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426
-
C:\ProgramData\Decoder.exeFilesize
490KB
MD5c29c0d495ed13e703f433d53bdffdab8
SHA174ed36e6b6027b61abcfe2956670ffd9de7fd71a
SHA25620309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b
SHA512fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426
-
C:\Users\Admin\AppData\Local\Temp\.cmdFilesize
85B
MD573712247036b6a24d16502c57a3e5679
SHA165ca9edadb0773fc34db7dfefe9e6416f1ac17fa
SHA2568bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0
SHA512548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de
-
memory/1840-137-0x0000000000000000-mapping.dmp
-
memory/2216-134-0x0000000000000000-mapping.dmp
-
memory/2632-130-0x0000000000B40000-0x0000000000CC4000-memory.dmpFilesize
1.5MB
-
memory/2632-131-0x00007FFE98390000-0x00007FFE98E51000-memory.dmpFilesize
10.8MB
-
memory/2632-138-0x00007FFE98390000-0x00007FFE98E51000-memory.dmpFilesize
10.8MB
-
memory/2924-132-0x0000000000000000-mapping.dmp
-
memory/2924-139-0x0000000004BC0000-0x0000000005164000-memory.dmpFilesize
5.6MB
-
memory/2924-140-0x0000000006330000-0x00000000063C2000-memory.dmpFilesize
584KB
-
memory/2924-141-0x0000000006590000-0x00000000065F6000-memory.dmpFilesize
408KB