Analysis

  • max time kernel
    151s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 20:54

General

  • Target

    1bd822a346fcb68e84ab86ec787319a96dcc7ca66542378c12b12f6932da17d5.exe

  • Size

    140KB

  • MD5

    6860cbee605a84d3379dd6cc319ce552

  • SHA1

    27073eb41749b4f8cb6c9388bbb7bcd060b7a322

  • SHA256

    1bd822a346fcb68e84ab86ec787319a96dcc7ca66542378c12b12f6932da17d5

  • SHA512

    7420a9a610f261df0575d4d407bfe4f6f357b169e80b482a0ba2d9d5820dbdc8598859737ba62a76315fef5005b763cfde730981686ba97cbddf8f57d9652675

  • SSDEEP

    768:zHIEayt4pd04q0zik+vhy7g0EM/LinbQON2:TUeEn3+pCg0EUGQON2

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bd822a346fcb68e84ab86ec787319a96dcc7ca66542378c12b12f6932da17d5.exe
    "C:\Users\Admin\AppData\Local\Temp\1bd822a346fcb68e84ab86ec787319a96dcc7ca66542378c12b12f6932da17d5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\soiobi.exe
      "C:\Users\Admin\soiobi.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1984

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\soiobi.exe

    Filesize

    140KB

    MD5

    0f2bd784faccea22b2954af6352024b1

    SHA1

    20946d3b1502f4fa3dd7a65c9e36fa341d6e51b3

    SHA256

    e68312d11a0bc56251ca5b49365602f3267815b7228e8453fe9f67cb8e498929

    SHA512

    bc26e7c80d583fdcaa5b144385cee0575dac77430b5f17604665e01db2222a913250ed7f0ecc12d8a386a8ae26eae401390f3b94fcd959803fd04ad79cdebfc7

  • C:\Users\Admin\soiobi.exe

    Filesize

    140KB

    MD5

    0f2bd784faccea22b2954af6352024b1

    SHA1

    20946d3b1502f4fa3dd7a65c9e36fa341d6e51b3

    SHA256

    e68312d11a0bc56251ca5b49365602f3267815b7228e8453fe9f67cb8e498929

    SHA512

    bc26e7c80d583fdcaa5b144385cee0575dac77430b5f17604665e01db2222a913250ed7f0ecc12d8a386a8ae26eae401390f3b94fcd959803fd04ad79cdebfc7

  • \Users\Admin\soiobi.exe

    Filesize

    140KB

    MD5

    0f2bd784faccea22b2954af6352024b1

    SHA1

    20946d3b1502f4fa3dd7a65c9e36fa341d6e51b3

    SHA256

    e68312d11a0bc56251ca5b49365602f3267815b7228e8453fe9f67cb8e498929

    SHA512

    bc26e7c80d583fdcaa5b144385cee0575dac77430b5f17604665e01db2222a913250ed7f0ecc12d8a386a8ae26eae401390f3b94fcd959803fd04ad79cdebfc7

  • \Users\Admin\soiobi.exe

    Filesize

    140KB

    MD5

    0f2bd784faccea22b2954af6352024b1

    SHA1

    20946d3b1502f4fa3dd7a65c9e36fa341d6e51b3

    SHA256

    e68312d11a0bc56251ca5b49365602f3267815b7228e8453fe9f67cb8e498929

    SHA512

    bc26e7c80d583fdcaa5b144385cee0575dac77430b5f17604665e01db2222a913250ed7f0ecc12d8a386a8ae26eae401390f3b94fcd959803fd04ad79cdebfc7

  • memory/1992-56-0x0000000076141000-0x0000000076143000-memory.dmp

    Filesize

    8KB