Analysis
-
max time kernel
137s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
10-10-2022 14:13
Static task
static1
General
-
Target
ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe
-
Size
650KB
-
MD5
d950b50f5f6430bec1db8de9f36b9a4e
-
SHA1
65a005725dc0c018ff8e5d20d57992cf0ad9a2d8
-
SHA256
ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89
-
SHA512
5a828a0d93a9a2d458a941ede1dfc27a672e1bd03ea99441cf34a163397c723788fc90565cde7cb5d7ff09a8a0aa26d267c8b93b54659f440b0b784f3bbbf478
-
SSDEEP
12288:GazUTpipJVJH0GpAl+N5IKOPri4BTVUDn8HC7Mvt6fDVyh:GNETR0GpAl+N5OTjUDnsC7u0O
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw
D5c27bWU8dvgdayPUMzKbc75CmsD9aUSDw
r4RkKWPKszhkZVTtXGBDNyrzcDPjpcnGNp
0xC4b495c6ef4B61d5757a1e78dE22edC315867C84
XshLZA5C9odmaiEfopX5DYvwMbnM4hqCME
TT7mceJ6BNhTPFqpaBy1ND1CWGwaGeqhpx
t1MrxfTEGEZioK7qjcDd48KVC5BMk7ccH8B
GCM62OODIUXHYPTVUZT2W4GKPIO7YMLZDNPR4NGUWLBU7KPOU7Q7E44X
48Zvk6W9kfXik8CEscQYjEZdDCVZtXNEGdjczTR4XD9SKfLWkirntGLR7UyhD7aas3C2N3QefcdB4gyLZt93CrmtP5WAeqJ
qz448vxrv9y6lsy0l4y6x98gylykleumxqnqs7fkn6
1AvqxpSfuNooDv2gn8rFNXiWP64bn7m8xa
0x7374d06666974119Fb6C8c1F10D4Ab7eCB724Fcd
LKcXMo6X6jGyk9o9phn4YvYUQ8QVR4wJgo
ronin:bb375c985bc63d448b3bc14cda06b2866f75e342
+79889916188
+79889916188
+79889916188
MJfnNkoXewo8QB5iu9dee2exwdavDxWRLC
ltc1q309prv3k8lc9gqd062eevjvxmkgyv00xe3m6jg
3Gs18Dq8SNrs3kLQdrpUFHa2yX8uD9ZXR7
bc1qhcynpwvj6lvdh393ph8tesk0mljsc6z3y40h2m
89PjhdrngYjeSa8dFeg6q8Sz4BXdrLLP8H8z82eUhTNjPBpTYkr3o6fWnkqng9D5TRaPT4HafXwUTJqcPE8SsbHUK5PM2Qx
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MoUSO.exepid process 4176 MoUSO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exedescription pid process target process PID 3844 set thread context of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exeMoUSO.exepid process 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe 4176 MoUSO.exe 4176 MoUSO.exe 4176 MoUSO.exe 4176 MoUSO.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exeMoUSO.exedescription pid process Token: SeDebugPrivilege 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe Token: SeDebugPrivilege 4176 MoUSO.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exeac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exeMoUSO.exedescription pid process target process PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3844 wrote to memory of 3636 3844 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe PID 3636 wrote to memory of 3652 3636 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe schtasks.exe PID 3636 wrote to memory of 3652 3636 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe schtasks.exe PID 3636 wrote to memory of 3652 3636 ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe schtasks.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe PID 4176 wrote to memory of 788 4176 MoUSO.exe MoUSO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe"C:\Users\Admin\AppData\Local\Temp\ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe"C:\Users\Admin\AppData\Local\Temp\ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeC:\Users\Admin\AppData\Local\cache\MoUSO.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exe"C:\Users\Admin\AppData\Local\cache\MoUSO.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeFilesize
650KB
MD5d950b50f5f6430bec1db8de9f36b9a4e
SHA165a005725dc0c018ff8e5d20d57992cf0ad9a2d8
SHA256ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89
SHA5125a828a0d93a9a2d458a941ede1dfc27a672e1bd03ea99441cf34a163397c723788fc90565cde7cb5d7ff09a8a0aa26d267c8b93b54659f440b0b784f3bbbf478
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeFilesize
650KB
MD5d950b50f5f6430bec1db8de9f36b9a4e
SHA165a005725dc0c018ff8e5d20d57992cf0ad9a2d8
SHA256ac1ee2ae3f9d02314391ea2cf5931325da346f5d40ea7cf12f4fb86e62fe1e89
SHA5125a828a0d93a9a2d458a941ede1dfc27a672e1bd03ea99441cf34a163397c723788fc90565cde7cb5d7ff09a8a0aa26d267c8b93b54659f440b0b784f3bbbf478
-
memory/3636-185-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3636-186-0x0000000000402DAA-mapping.dmp
-
memory/3636-187-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3636-188-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3636-224-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3636-261-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3652-259-0x0000000000000000-mapping.dmp
-
memory/3844-150-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-124-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-121-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-153-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-123-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-154-0x00000000051E0000-0x0000000005272000-memory.dmpFilesize
584KB
-
memory/3844-125-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-126-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-127-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-128-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-129-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-130-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-131-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-132-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-133-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-134-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-135-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-136-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-137-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-138-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-139-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-140-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-141-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-142-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-143-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-144-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-145-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-146-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-147-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-148-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-149-0x0000000000C90000-0x0000000000D38000-memory.dmpFilesize
672KB
-
memory/3844-119-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-151-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-152-0x0000000005800000-0x0000000005CFE000-memory.dmpFilesize
5.0MB
-
memory/3844-122-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-155-0x0000000005300000-0x000000000539C000-memory.dmpFilesize
624KB
-
memory/3844-120-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-156-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-157-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-158-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-159-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-160-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-161-0x0000000005150000-0x0000000005180000-memory.dmpFilesize
192KB
-
memory/3844-162-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-163-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-164-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-165-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-166-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-167-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-168-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-169-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-170-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-171-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-172-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-173-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-174-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-175-0x00000000052A0000-0x00000000052AA000-memory.dmpFilesize
40KB
-
memory/3844-176-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-177-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-178-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-179-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-118-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-117-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-116-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-115-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-180-0x0000000007730000-0x0000000007748000-memory.dmpFilesize
96KB
-
memory/3844-181-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-182-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3844-183-0x0000000007FB0000-0x0000000007FCA000-memory.dmpFilesize
104KB
-
memory/3844-184-0x0000000007F90000-0x0000000007F96000-memory.dmpFilesize
24KB
-
memory/4176-317-0x0000000000BD0000-0x0000000000C78000-memory.dmpFilesize
672KB