Analysis
-
max time kernel
97s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2022 05:40
Static task
static1
Behavioral task
behavioral1
Sample
5986aff76e7813045b1b130efbb10d30.exe
Resource
win7-20220812-en
General
-
Target
5986aff76e7813045b1b130efbb10d30.exe
-
Size
1.9MB
-
MD5
5986aff76e7813045b1b130efbb10d30
-
SHA1
62b1f733fe7ed0c0230c20dae3c4a65ecb28e180
-
SHA256
7dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62
-
SHA512
bfa2cad2bbbb61af7dbd22818db048ddaf68e2e22d1c55d80450a7a0c4c31c09bf596f04ebc2a7f55ac70c294ae01d3e8987af4d0bbb60c63662d21c008b3115
-
SSDEEP
24576:ytmVBxgdQncWHOY7XgOxv5zM44Q84u7cpS/G6bLZLI6FMPNK/bAkA/lDA:Jjou3H/Dxxr40uIB6bO6mYPAS
Malware Config
Extracted
systembc
89.22.225.242:4193
195.2.93.22:4193
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
DllResource.exepid process 4616 DllResource.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5986aff76e7813045b1b130efbb10d30.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 5986aff76e7813045b1b130efbb10d30.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
5986aff76e7813045b1b130efbb10d30.exeDllResource.exepid process 4636 5986aff76e7813045b1b130efbb10d30.exe 4636 5986aff76e7813045b1b130efbb10d30.exe 4636 5986aff76e7813045b1b130efbb10d30.exe 4636 5986aff76e7813045b1b130efbb10d30.exe 4636 5986aff76e7813045b1b130efbb10d30.exe 4636 5986aff76e7813045b1b130efbb10d30.exe 4636 5986aff76e7813045b1b130efbb10d30.exe 4636 5986aff76e7813045b1b130efbb10d30.exe 4636 5986aff76e7813045b1b130efbb10d30.exe 4636 5986aff76e7813045b1b130efbb10d30.exe 4616 DllResource.exe 4616 DllResource.exe 4616 DllResource.exe 4616 DllResource.exe 4616 DllResource.exe 4616 DllResource.exe 4616 DllResource.exe 4616 DllResource.exe 4616 DllResource.exe 4616 DllResource.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
5986aff76e7813045b1b130efbb10d30.execmd.exedescription pid process target process PID 4636 wrote to memory of 3392 4636 5986aff76e7813045b1b130efbb10d30.exe schtasks.exe PID 4636 wrote to memory of 3392 4636 5986aff76e7813045b1b130efbb10d30.exe schtasks.exe PID 4636 wrote to memory of 3392 4636 5986aff76e7813045b1b130efbb10d30.exe schtasks.exe PID 4636 wrote to memory of 4616 4636 5986aff76e7813045b1b130efbb10d30.exe DllResource.exe PID 4636 wrote to memory of 4616 4636 5986aff76e7813045b1b130efbb10d30.exe DllResource.exe PID 4636 wrote to memory of 4616 4636 5986aff76e7813045b1b130efbb10d30.exe DllResource.exe PID 4636 wrote to memory of 3168 4636 5986aff76e7813045b1b130efbb10d30.exe cmd.exe PID 4636 wrote to memory of 3168 4636 5986aff76e7813045b1b130efbb10d30.exe cmd.exe PID 4636 wrote to memory of 3168 4636 5986aff76e7813045b1b130efbb10d30.exe cmd.exe PID 3168 wrote to memory of 3088 3168 cmd.exe chcp.com PID 3168 wrote to memory of 3088 3168 cmd.exe chcp.com PID 3168 wrote to memory of 3088 3168 cmd.exe chcp.com PID 3168 wrote to memory of 668 3168 cmd.exe PING.EXE PID 3168 wrote to memory of 668 3168 cmd.exe PING.EXE PID 3168 wrote to memory of 668 3168 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5986aff76e7813045b1b130efbb10d30.exe"C:\Users\Admin\AppData\Local\Temp\5986aff76e7813045b1b130efbb10d30.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\TypeRes\DllResource.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\TypeRes\DllResource.exe"C:\Users\Admin\TypeRes\DllResource.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\5986aff76e7813045b1b130efbb10d30.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\TypeRes\DllResource.exeFilesize
680.8MB
MD57bbe9a1765964d7c182e5c54504edbcf
SHA1e51f68b53b56339321746a2bbe6da50f1fd89fce
SHA2566ae433228eba154ca6b978517e895b68c38bb218143cec923da39331dbd980c5
SHA5128cb251dff7d397aee9e329ab3d7f99b552dbfe1960417bdd06f977ee0b70e40dc7043704041a8be28c433ddd351192d39ec6f9380f2b2af1989588ad969ae48e
-
C:\Users\Admin\TypeRes\DllResource.exeFilesize
709.7MB
MD5ae6a29a697c81f90e712fc04481eecf3
SHA1edfde0213d81d827a95f5d989f5a0dcbc6f43f97
SHA2567a103617978cd24011e377e4274b905fcb5a8faa45ccd4f7fbf393761777df68
SHA51267ae34a21cd4b2cfa93e749137c9f9c587f2b357a52756b6d18110c90671484b855cf57ab8631753fed85d1055c3eb9513fd1fcdda49ccbcd8dbc4865c98dba1
-
memory/668-143-0x0000000000000000-mapping.dmp
-
memory/3088-142-0x0000000000000000-mapping.dmp
-
memory/3168-140-0x0000000000000000-mapping.dmp
-
memory/3392-136-0x0000000000000000-mapping.dmp
-
memory/4616-137-0x0000000000000000-mapping.dmp
-
memory/4616-148-0x0000000010E20000-0x0000000010EB1000-memory.dmpFilesize
580KB
-
memory/4616-153-0x0000000010E20000-0x0000000010EB1000-memory.dmpFilesize
580KB
-
memory/4616-150-0x0000000010E00000-0x0000000010E07000-memory.dmpFilesize
28KB
-
memory/4616-149-0x0000000010E20000-0x0000000010EB1000-memory.dmpFilesize
580KB
-
memory/4616-147-0x0000000002B2F000-0x0000000002CAE000-memory.dmpFilesize
1.5MB
-
memory/4616-144-0x000000000238C000-0x0000000002B1C000-memory.dmpFilesize
7.6MB
-
memory/4616-145-0x0000000002B2F000-0x0000000002CAE000-memory.dmpFilesize
1.5MB
-
memory/4616-146-0x000000000238C000-0x0000000002B1C000-memory.dmpFilesize
7.6MB
-
memory/4636-133-0x0000000002D9F000-0x0000000002F1E000-memory.dmpFilesize
1.5MB
-
memory/4636-132-0x00000000025F5000-0x0000000002D85000-memory.dmpFilesize
7.6MB
-
memory/4636-134-0x00000000025F5000-0x0000000002D85000-memory.dmpFilesize
7.6MB
-
memory/4636-141-0x0000000002D9F000-0x0000000002F1E000-memory.dmpFilesize
1.5MB
-
memory/4636-135-0x0000000002D9F000-0x0000000002F1E000-memory.dmpFilesize
1.5MB