Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2022 16:47
Static task
static1
Behavioral task
behavioral1
Sample
iCloud_5778420644664315372.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
iCloud_5778420644664315372.exe
Resource
win10v2004-20220901-en
General
-
Target
iCloud_5778420644664315372.exe
-
Size
6.0MB
-
MD5
37580d09f99717268666e091c21d344a
-
SHA1
0b7df2ebdf61753c183c818db71b4b1f6fd57841
-
SHA256
12d9848e317dcbf7dfb95649d7198fd93475f8b4cd093a252f28caeed8093001
-
SHA512
f2a1295003d64be1c768afbc6bd0f93ba53a39a883759952246371d9552777432193c35a702697061febb192cb365843480cc52c3dc44d90312a4e8be7e66749
-
SSDEEP
98304:JyQZRhelFuTw99bP/nCURx/PKnBWrmVjefsn+1:sQ7w99GURx/PKwQe
Malware Config
Extracted
bitrat
1.35
snkno.duckdns.org:43413
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
iCloud.exeAddInProcess32.exepid process 1996 iCloud.exe 4148 AddInProcess32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
iCloud_5778420644664315372.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation iCloud_5778420644664315372.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apple = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\iCloud.exe" reg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
AddInProcess32.exepid process 4148 AddInProcess32.exe 4148 AddInProcess32.exe 4148 AddInProcess32.exe 4148 AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
iCloud.exedescription pid process target process PID 1996 set thread context of 4148 1996 iCloud.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
iCloud_5778420644664315372.exeiCloud.exepid process 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 2784 iCloud_5778420644664315372.exe 1996 iCloud.exe 1996 iCloud.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
iCloud_5778420644664315372.exeiCloud.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 2784 iCloud_5778420644664315372.exe Token: SeDebugPrivilege 1996 iCloud.exe Token: SeShutdownPrivilege 4148 AddInProcess32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AddInProcess32.exepid process 4148 AddInProcess32.exe 4148 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
iCloud_5778420644664315372.execmd.exeiCloud.exedescription pid process target process PID 2784 wrote to memory of 1284 2784 iCloud_5778420644664315372.exe cmd.exe PID 2784 wrote to memory of 1284 2784 iCloud_5778420644664315372.exe cmd.exe PID 2784 wrote to memory of 1284 2784 iCloud_5778420644664315372.exe cmd.exe PID 1284 wrote to memory of 1620 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1620 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1620 1284 cmd.exe reg.exe PID 2784 wrote to memory of 1996 2784 iCloud_5778420644664315372.exe iCloud.exe PID 2784 wrote to memory of 1996 2784 iCloud_5778420644664315372.exe iCloud.exe PID 2784 wrote to memory of 1996 2784 iCloud_5778420644664315372.exe iCloud.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe PID 1996 wrote to memory of 4148 1996 iCloud.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\iCloud_5778420644664315372.exe"C:\Users\Admin\AppData\Local\Temp\iCloud_5778420644664315372.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "apple" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "apple" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exeFilesize
6.0MB
MD537580d09f99717268666e091c21d344a
SHA10b7df2ebdf61753c183c818db71b4b1f6fd57841
SHA25612d9848e317dcbf7dfb95649d7198fd93475f8b4cd093a252f28caeed8093001
SHA512f2a1295003d64be1c768afbc6bd0f93ba53a39a883759952246371d9552777432193c35a702697061febb192cb365843480cc52c3dc44d90312a4e8be7e66749
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\iCloud.exeFilesize
6.0MB
MD537580d09f99717268666e091c21d344a
SHA10b7df2ebdf61753c183c818db71b4b1f6fd57841
SHA25612d9848e317dcbf7dfb95649d7198fd93475f8b4cd093a252f28caeed8093001
SHA512f2a1295003d64be1c768afbc6bd0f93ba53a39a883759952246371d9552777432193c35a702697061febb192cb365843480cc52c3dc44d90312a4e8be7e66749
-
memory/1284-138-0x0000000000000000-mapping.dmp
-
memory/1620-139-0x0000000000000000-mapping.dmp
-
memory/1996-140-0x0000000000000000-mapping.dmp
-
memory/2784-137-0x0000000006F60000-0x0000000006F82000-memory.dmpFilesize
136KB
-
memory/2784-133-0x0000000005DE0000-0x0000000006384000-memory.dmpFilesize
5.6MB
-
memory/2784-136-0x0000000006FA0000-0x0000000007006000-memory.dmpFilesize
408KB
-
memory/2784-135-0x00000000058D0000-0x000000000596C000-memory.dmpFilesize
624KB
-
memory/2784-134-0x0000000005740000-0x00000000057D2000-memory.dmpFilesize
584KB
-
memory/2784-132-0x00000000008F0000-0x0000000000EFC000-memory.dmpFilesize
6.0MB
-
memory/4148-144-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4148-143-0x0000000000000000-mapping.dmp
-
memory/4148-146-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4148-147-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4148-148-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4148-149-0x0000000070680000-0x00000000706B9000-memory.dmpFilesize
228KB
-
memory/4148-150-0x0000000070760000-0x0000000070799000-memory.dmpFilesize
228KB
-
memory/4148-151-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4148-152-0x0000000070760000-0x0000000070799000-memory.dmpFilesize
228KB