Analysis

  • max time kernel
    119s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 14:58

General

  • Target

    2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe

  • Size

    390KB

  • MD5

    6b990e2a7cdf89f93d4f7fc977224f1c

  • SHA1

    3b5b87866f0b73f465763ebf7c7f49c7f026758c

  • SHA256

    2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc

  • SHA512

    db40969d543cfc009e27f26744617e995d738d30abc6f1f7a61d31a4cca5fbd6a29db8ffa8b65ed81a0c3efcc9b8f397da25a9529ad765ce7cae71d49d7873d8

  • SSDEEP

    6144:ebDJSegYiFS3rBkr7IlcssWLrfqKTmDFmUr4H0JXJHtgxOZ9Em9Evl:e7gN0r+0DsCqVvkH0JXJHEOZ1Wvl

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe
    "C:\Users\Admin\AppData\Local\Temp\2b5155b6e823a0dc5e01d86e2773cc2b7bcc02a5c3ab8ed496297b7fb0ca04dc.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Users\Admin\AppData\Local\Temp\SO-MoneyHack v2.0.exe
      "C:\Users\Admin\AppData\Local\Temp\SO-MoneyHack v2.0.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3308

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SO-MoneyHack v2.0.exe

    Filesize

    300KB

    MD5

    68f0dbc20c592161fad427c472f4e61f

    SHA1

    e0119274e1f14d136324bb6b3e5bde87bf999b3f

    SHA256

    479a30d7ee0286c2742dcc38422dc192b5bc0b60afa91ab51d7933060f41bb66

    SHA512

    b7e5cd20cda2266e710e948cf832f799949dab9421098cff78adf1f6f296903bd2a0833c4eae24729173a6275c0434cd13ad682f0056086f2c89a4ae3042bd38

  • C:\Users\Admin\AppData\Local\Temp\SO-MoneyHack v2.0.exe

    Filesize

    300KB

    MD5

    68f0dbc20c592161fad427c472f4e61f

    SHA1

    e0119274e1f14d136324bb6b3e5bde87bf999b3f

    SHA256

    479a30d7ee0286c2742dcc38422dc192b5bc0b60afa91ab51d7933060f41bb66

    SHA512

    b7e5cd20cda2266e710e948cf832f799949dab9421098cff78adf1f6f296903bd2a0833c4eae24729173a6275c0434cd13ad682f0056086f2c89a4ae3042bd38

  • memory/2132-132-0x0000000000400000-0x00000000004A4000-memory.dmp

    Filesize

    656KB

  • memory/2132-136-0x0000000000400000-0x00000000004A4000-memory.dmp

    Filesize

    656KB

  • memory/2132-140-0x0000000000400000-0x00000000004A4000-memory.dmp

    Filesize

    656KB

  • memory/3308-137-0x0000000004C40000-0x00000000051E4000-memory.dmp

    Filesize

    5.6MB

  • memory/3308-138-0x0000000004B40000-0x0000000004BD2000-memory.dmp

    Filesize

    584KB

  • memory/3308-139-0x0000000005220000-0x000000000522A000-memory.dmp

    Filesize

    40KB