Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
30-07-2022 08:37
Static task
static1
Behavioral task
behavioral1
Sample
Radicado De La Denuncia.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
Radicado De La Denuncia.exe
Resource
win10v2004-20220721-en
General
-
Target
Radicado De La Denuncia.exe
-
Size
1.1MB
-
MD5
f4870d32cab14312598325c151c86f98
-
SHA1
2b6799150e4fe9947fe2d13ef929862d8f4649d3
-
SHA256
a1031a4ec54eb26124df7ecbb1dd0feb65434db2b97a3738de938f74ecb2527f
-
SHA512
2fd80500d76e7d7f4d47361bace130d967a3de23bae0b3251494da50c9a1d1769b7448c516311807b06f88323c65ad5aaf40a8dddecdefc221fa119436809ba0
Malware Config
Extracted
bitrat
1.38
marcete.duckdns.org:9090
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
AppData.exe
-
install_file
listooo
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Radicado De La Denuncia.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation Radicado De La Denuncia.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Radicado De La Denuncia.exeInstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ziripfszn\\chrome.exe\"" Radicado De La Denuncia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\listooo = "C:\\Users\\Admin\\AppData\\Local\\AppData.exe\\listoooĀ" InstallUtil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\listooo = "C:\\Users\\Admin\\AppData\\Local\\AppData.exe\\listooo" InstallUtil.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\listooo = "C:\\Users\\Admin\\AppData\\Local\\AppData.exe\\listooo䄀" InstallUtil.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
InstallUtil.exepid process 3316 InstallUtil.exe 3316 InstallUtil.exe 3316 InstallUtil.exe 3316 InstallUtil.exe 3316 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Radicado De La Denuncia.exedescription pid process target process PID 2104 set thread context of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeRadicado De La Denuncia.exepid process 3628 powershell.exe 3628 powershell.exe 2104 Radicado De La Denuncia.exe 2104 Radicado De La Denuncia.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Radicado De La Denuncia.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2104 Radicado De La Denuncia.exe Token: SeDebugPrivilege 3628 powershell.exe Token: SeShutdownPrivilege 3316 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
InstallUtil.exepid process 3316 InstallUtil.exe 3316 InstallUtil.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Radicado De La Denuncia.exedescription pid process target process PID 2104 wrote to memory of 3628 2104 Radicado De La Denuncia.exe powershell.exe PID 2104 wrote to memory of 3628 2104 Radicado De La Denuncia.exe powershell.exe PID 2104 wrote to memory of 3628 2104 Radicado De La Denuncia.exe powershell.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe PID 2104 wrote to memory of 3316 2104 Radicado De La Denuncia.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Radicado De La Denuncia.exe"C:\Users\Admin\AppData\Local\Temp\Radicado De La Denuncia.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2104-131-0x0000000005CE0000-0x0000000006284000-memory.dmpFilesize
5.6MB
-
memory/2104-132-0x0000000007E30000-0x0000000007E52000-memory.dmpFilesize
136KB
-
memory/2104-130-0x0000000000BA0000-0x0000000000CC2000-memory.dmpFilesize
1.1MB
-
memory/3316-142-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/3316-149-0x0000000074B80000-0x0000000074BB9000-memory.dmpFilesize
228KB
-
memory/3316-148-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/3316-147-0x0000000074840000-0x0000000074879000-memory.dmpFilesize
228KB
-
memory/3316-146-0x0000000074B80000-0x0000000074BB9000-memory.dmpFilesize
228KB
-
memory/3316-145-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/3316-144-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/3316-143-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/3316-141-0x0000000000000000-mapping.dmp
-
memory/3628-135-0x0000000005800000-0x0000000005E28000-memory.dmpFilesize
6.2MB
-
memory/3628-140-0x0000000006C00000-0x0000000006C1A000-memory.dmpFilesize
104KB
-
memory/3628-139-0x0000000007D70000-0x00000000083EA000-memory.dmpFilesize
6.5MB
-
memory/3628-138-0x0000000006720000-0x000000000673E000-memory.dmpFilesize
120KB
-
memory/3628-137-0x0000000006010000-0x0000000006076000-memory.dmpFilesize
408KB
-
memory/3628-136-0x0000000005EA0000-0x0000000005F06000-memory.dmpFilesize
408KB
-
memory/3628-134-0x0000000003130000-0x0000000003166000-memory.dmpFilesize
216KB
-
memory/3628-133-0x0000000000000000-mapping.dmp