Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 04:19
Static task
static1
Behavioral task
behavioral1
Sample
5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe
Resource
win7-20220718-en
General
-
Target
5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe
-
Size
4.4MB
-
MD5
3f17a33300b3611e055c29ff101021bb
-
SHA1
ec963dc4cbed5fa5c3a72711dc56c3a75abbfd0f
-
SHA256
5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82
-
SHA512
d08929039416e57477f8d5dc70e7618c3a2b08c613d5bc58452f68e69acfef96db7f74d72d842a008e754ed21518c74cf8f864078f979434b3c0f17b75529f5f
Malware Config
Signatures
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
Setupres.exeSetup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setupres.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe -
Blocklisted process makes network request 2 IoCs
Processes:
CScript.exeflow pid process 9 4212 CScript.exe 11 4212 CScript.exe -
Executes dropped EXE 2 IoCs
Processes:
Setup.exeSetupres.exepid process 4272 Setup.exe 4604 Setupres.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup.exeSetupres.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setupres.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setupres.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Setupres.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation Setupres.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Setupres.exeSetup.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Wine Setupres.exe Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Wine Setup.exe -
Loads dropped DLL 2 IoCs
Processes:
5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exepid process 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Setup.exeSetupres.exepid process 4272 Setup.exe 4604 Setupres.exe -
Drops file in Program Files directory 18 IoCs
Processes:
5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exedescription ioc process File created C:\Program Files (x86)\Ferr\SEDA\countries.tsv 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\SX\bin\superb.ovpn 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\TAP-Windows\bin\addtap.bat 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\vpnpro.PTB.lng 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\TAP-Windows\driver\OemVista.inf 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\TAP-Windows\driver\tap0901.sys 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\SX\bin\Setup.exe 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\SX\bin\Setupres.exe 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\TAP-Windows\bin\devcon.exe 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\TAP-Windows\bin\tapinstall.exe 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\vpnpro.RUS.lng 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\SX\bin\vpn850936802.ovpn 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\SX\bin\ipras.vbs 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\TAP-Windows\driver\OemWin2k.inf 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\TAP-Windows\driver\tap0901.cat 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\SX\bin\ssleay32.dll 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\SX\bin\test.ovpn 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe File created C:\Program Files (x86)\Ferr\SEDA\TAP-Windows\bin\deltapall.bat 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exeSetupres.exepid process 4272 Setup.exe 4272 Setup.exe 4604 Setupres.exe 4604 Setupres.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
Setup.exepid process 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe 4272 Setup.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exedescription pid process target process PID 3052 wrote to memory of 4272 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe Setup.exe PID 3052 wrote to memory of 4272 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe Setup.exe PID 3052 wrote to memory of 4272 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe Setup.exe PID 3052 wrote to memory of 4212 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe CScript.exe PID 3052 wrote to memory of 4212 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe CScript.exe PID 3052 wrote to memory of 4212 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe CScript.exe PID 3052 wrote to memory of 4604 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe Setupres.exe PID 3052 wrote to memory of 4604 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe Setupres.exe PID 3052 wrote to memory of 4604 3052 5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe Setupres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe"C:\Users\Admin\AppData\Local\Temp\5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Ferr\SEDA\SX\bin\Setup.exe"C:\Program Files (x86)\Ferr\SEDA\SX\bin\Setup.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\CScript.exe"C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\Ferr\SEDA\SX\bin\ipras.vbs" //e:vbscript //B //NOLOGO2⤵
- Blocklisted process makes network request
-
C:\Program Files (x86)\Ferr\SEDA\SX\bin\Setupres.exe"C:\Program Files (x86)\Ferr\SEDA\SX\bin\Setupres.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Ferr\SEDA\SX\bin\Setup.exeFilesize
2.2MB
MD5edcd2a2017aa0ddc5fa0cf3d28137420
SHA1b156413a4b40a221960f2ea5026718b0155f74d9
SHA256a6f524f741d6de2d967d266d26775fd3a2d05ba34a738e8c7e4656d7260f1431
SHA512fd575b40fc2969966db06515d178282248d1f922cc53c417f19cf9b85e5de68866b572d8537e4081e699f8fbe865280b5449a917a22086bad51ec649a0341300
-
C:\Program Files (x86)\Ferr\SEDA\SX\bin\Setup.exeFilesize
2.2MB
MD5edcd2a2017aa0ddc5fa0cf3d28137420
SHA1b156413a4b40a221960f2ea5026718b0155f74d9
SHA256a6f524f741d6de2d967d266d26775fd3a2d05ba34a738e8c7e4656d7260f1431
SHA512fd575b40fc2969966db06515d178282248d1f922cc53c417f19cf9b85e5de68866b572d8537e4081e699f8fbe865280b5449a917a22086bad51ec649a0341300
-
C:\Program Files (x86)\Ferr\SEDA\SX\bin\Setupres.exeFilesize
2.0MB
MD5e090b0a50ddd9296a8f8f034e1c31d9b
SHA114d28e0960b78accf137b954cb4989984c7754e1
SHA25641bbdd8cabb7c12955519a81afc13062b9a96ba6966611f8ce90c567475e8772
SHA51223bd5e34af7ce67d342175a379abe8e0523db473be8782ba3070ed7e669434c73b9b40461724454e1f4ebaa38a28c06493f0d44d07879343d6899af80a50111f
-
C:\Program Files (x86)\Ferr\SEDA\SX\bin\ipras.vbsFilesize
126B
MD5b802ff9244875f69db2fae0f78e92b10
SHA149385a89cd575894a29fbda969b99cc1f5cf8076
SHA256a1b0cb16fb2ecd66fccf156024404801ad694056e8a596326c1b27b57d8eabe8
SHA512609856415a7ae2b3e260f945f1c8a8d2a28884c202d37181bea948708918f24b42ae03f17dba1520fddc91b2f7a182b0b8f885f33ea6f81bb3ee4c72e4e9350e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751Filesize
717B
MD5ec8ff3b1ded0246437b1472c69dd1811
SHA1d813e874c2524e3a7da6c466c67854ad16800326
SHA256e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751Filesize
192B
MD50c524b79f623754b434227e67b9e80ec
SHA1060bb22a2423d5fb351b6433a2384c09e36e1e9d
SHA2569571554a740eb8d59e1ad563b630ed9274e23419370a7d254408f52aeb47a3a4
SHA5124fc00682d70fc0d66fd299ccfe8f24cb5c6bd9a2d92b05a4de9f18bd138c852a274ed4916950548bb262eda5e424a96d2e0f207b2556e202676911953c89b1ea
-
C:\Users\Admin\AppData\Local\Temp\nsw7F67.tmp\UAC.dllFilesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
C:\Users\Admin\AppData\Local\Temp\nsw7F67.tmp\nsExec.dllFilesize
6KB
MD5132e6153717a7f9710dcea4536f364cd
SHA1e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA256d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
SHA5129aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
-
memory/4212-135-0x0000000000000000-mapping.dmp
-
memory/4272-140-0x0000000077400000-0x00000000775A3000-memory.dmpFilesize
1.6MB
-
memory/4272-146-0x0000000077400000-0x00000000775A3000-memory.dmpFilesize
1.6MB
-
memory/4272-141-0x0000000000DA0000-0x00000000012E2000-memory.dmpFilesize
5.3MB
-
memory/4272-131-0x0000000000000000-mapping.dmp
-
memory/4272-137-0x0000000000DA0000-0x00000000012E2000-memory.dmpFilesize
5.3MB
-
memory/4272-147-0x0000000000DA0000-0x00000000012E2000-memory.dmpFilesize
5.3MB
-
memory/4272-145-0x0000000000DA0000-0x00000000012E2000-memory.dmpFilesize
5.3MB
-
memory/4604-143-0x0000000077400000-0x00000000775A3000-memory.dmpFilesize
1.6MB
-
memory/4604-144-0x0000000000400000-0x0000000000914000-memory.dmpFilesize
5.1MB
-
memory/4604-148-0x0000000000400000-0x0000000000914000-memory.dmpFilesize
5.1MB
-
memory/4604-149-0x0000000077400000-0x00000000775A3000-memory.dmpFilesize
1.6MB
-
memory/4604-150-0x0000000000400000-0x0000000000914000-memory.dmpFilesize
5.1MB
-
memory/4604-138-0x0000000000000000-mapping.dmp
-
memory/4604-142-0x0000000000400000-0x0000000000914000-memory.dmpFilesize
5.1MB