7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc

Analysis

max time kernel
152s
max time network
78s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe
Size

702KB
MD5

6d27377d1619e5e7b8022f3c064c0cc0
SHA1

39507f40d2f6df8da3709fc8de3e9494df97d613
SHA256

7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc
SHA512

c354f5c92f5a8bb3f7be9bfbf1c5989c3c6541d27ae79b1c3f0f1b6660b0b940f6e9b86db893ac1f214517b92f773a0f048df23d6f6c1e0e8959247df1edbdd4
SSDEEP

12288:VHjcoe9PH96vB/fAuBcm9TyOE/xG3muGx44MG4Yx:VDgINfAuBcgcZG2uG24MG4Y

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1452	igbotef.exe
2044	~DFA52.tmp
652	ypelorc.exe

Deletes itself 1 IoCs

pid	Process
1120	cmd.exe

Loads dropped DLL 3 IoCs

pid	Process
1932	7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe
1452	igbotef.exe
2044	~DFA52.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe
652	ypelorc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	~DFA52.tmp

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1452	1932	7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe	28
PID 1932 wrote to memory of 1452	1932	7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe	28
PID 1932 wrote to memory of 1452	1932	7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe	28
PID 1932 wrote to memory of 1452	1932	7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe	28
PID 1932 wrote to memory of 1120	1932	7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe	29
PID 1932 wrote to memory of 1120	1932	7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe	29
PID 1932 wrote to memory of 1120	1932	7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe	29
PID 1932 wrote to memory of 1120	1932	7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe	29
PID 1452 wrote to memory of 2044	1452	igbotef.exe	31
PID 1452 wrote to memory of 2044	1452	igbotef.exe	31
PID 1452 wrote to memory of 2044	1452	igbotef.exe	31
PID 1452 wrote to memory of 2044	1452	igbotef.exe	31
PID 2044 wrote to memory of 652	2044	~DFA52.tmp	32
PID 2044 wrote to memory of 652	2044	~DFA52.tmp	32
PID 2044 wrote to memory of 652	2044	~DFA52.tmp	32
PID 2044 wrote to memory of 652	2044	~DFA52.tmp	32

C:\Users\Admin\AppData\Local\Temp\7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe
"C:\Users\Admin\AppData\Local\Temp\7354d802ec4adf963ce599c37bd752643d044f1c728355c829c5946c72c1e8dc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\igbotef.exe
  C:\Users\Admin\AppData\Local\Temp\igbotef.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Users\Admin\AppData\Local\Temp\~DFA52.tmp
    C:\Users\Admin\AppData\Local\Temp\~DFA52.tmp OK
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\ypelorc.exe
      "C:\Users\Admin\AppData\Local\Temp\ypelorc.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uninsep.bat" "
  2⤵
  - Deletes itself
  PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uninsep.bat

Filesize
341B

MD5
7be015d7c5d3f7ae5279d54751c324d0

SHA1
2c88fb7e84aee6a88f7ebf703af0ab8e6e190f88

SHA256
b73f0d75912fbb2ca12c1bec8708f61c05631a455b0bc65d42f1e8482c16bfba

SHA512
75bf1cc7ab0f4079a9fba3600f01af454d455104223e9d0ecb264207c3803e5343323809226498c3db7297797490c93dc283ef5f7eb636dd6e7268124c699adc

Download Submit
C:\Users\Admin\AppData\Local\Temp\gbp.ini

Filesize
104B

MD5
86bb2dbeaef655893262f3c041f6afe2

SHA1
1b26ff1241c1353bd506c18bd0c11878076ba65d

SHA256
4a57643d2c59d1235bc0926f845583f39345839e3e9428ad619eb4b6baf96ad2

SHA512
58294cfaa5882a4c5625c03fe6f9e4882912b31f7169241f95626745d66c0a746083a9044365943d66ae7a420113d28c0ddd642c4ed697c683deb63796a13d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
480B

MD5
c57f35fdf6fc13fa1988786f9fcb2a92

SHA1
a2dd0137feab0c62a4e5109f7a5b6c4f61c1274b

SHA256
1bdb4164f0234d8cb0e7139ceb5b9084992a156f1f019b4e157bf67289323c8e

SHA512
09ef7785b1e5cc17f7b23853bea699e8a914e0ba5e49d27071b95daa6313bdcf6a95f029e2bf5779155e8ae011fb907a9e0c19f73b6a438e449544c115f9888d

Download Submit
C:\Users\Admin\AppData\Local\Temp\igbotef.exe

Filesize
704KB

MD5
6e1c6bdbfb536f745f853d00cdab1b24

SHA1
87c96a7cc8468f185d25caa4eba44c2048c20e67

SHA256
2ed81b0634a3a176e13fdef424ae081914527702595079eda834617b7552e38c

SHA512
62264dc1777295b9cc564500288251a5290455350b5ae1dd122f23351dfe96f3b97d0cbf8e8f03ca817b3fe5d08c0c0173245f95c6ce621c7d0f90c2ad1528aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\igbotef.exe

Filesize
704KB

MD5
6e1c6bdbfb536f745f853d00cdab1b24

SHA1
87c96a7cc8468f185d25caa4eba44c2048c20e67

SHA256
2ed81b0634a3a176e13fdef424ae081914527702595079eda834617b7552e38c

SHA512
62264dc1777295b9cc564500288251a5290455350b5ae1dd122f23351dfe96f3b97d0cbf8e8f03ca817b3fe5d08c0c0173245f95c6ce621c7d0f90c2ad1528aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ypelorc.exe

Filesize
371KB

MD5
bd0bd406f27bb5108f458a85731ac6da

SHA1
9da460263a7acf77a0de4a8e98ea0d7c17e044a4

SHA256
439c7ec8ee7980c9fcf93a0acac883fe758f748be37803748c7fa204f5fe88bb

SHA512
06aee997258ea1c1f77913b023cdc1588be15db3c6c8956bb6d1c0fc338ec5f60d5511463e96b31c92a544c5d1432341b7ab06c5acc01b8a5cf441afa9f1e869

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFA52.tmp

Filesize
707KB

MD5
9a7dfa785b891c5ed5673e058f39f6a3

SHA1
ce8df1a35fa6e197d676b65507dbbe3ff78fda81

SHA256
ffae395494812908a932724968af51a981ee0a678e69ea3cc76c888a169c0210

SHA512
28d5c751c2e95f77a6f5db4d941fc8d85ba288af7ebf275e8c5e2aaa38bd29eaac9e3a195cf9d4dd60ce90b8dee4b8999744daf74df25a198f8c26f88d638963

Download Submit
\Users\Admin\AppData\Local\Temp\igbotef.exe

Filesize
704KB

MD5
6e1c6bdbfb536f745f853d00cdab1b24

SHA1
87c96a7cc8468f185d25caa4eba44c2048c20e67

SHA256
2ed81b0634a3a176e13fdef424ae081914527702595079eda834617b7552e38c

SHA512
62264dc1777295b9cc564500288251a5290455350b5ae1dd122f23351dfe96f3b97d0cbf8e8f03ca817b3fe5d08c0c0173245f95c6ce621c7d0f90c2ad1528aa

Download Submit
\Users\Admin\AppData\Local\Temp\ypelorc.exe

Filesize
371KB

MD5
bd0bd406f27bb5108f458a85731ac6da

SHA1
9da460263a7acf77a0de4a8e98ea0d7c17e044a4

SHA256
439c7ec8ee7980c9fcf93a0acac883fe758f748be37803748c7fa204f5fe88bb

SHA512
06aee997258ea1c1f77913b023cdc1588be15db3c6c8956bb6d1c0fc338ec5f60d5511463e96b31c92a544c5d1432341b7ab06c5acc01b8a5cf441afa9f1e869

Download Submit
\Users\Admin\AppData\Local\Temp\~DFA52.tmp

Filesize
707KB

MD5
9a7dfa785b891c5ed5673e058f39f6a3

SHA1
ce8df1a35fa6e197d676b65507dbbe3ff78fda81

SHA256
ffae395494812908a932724968af51a981ee0a678e69ea3cc76c888a169c0210

SHA512
28d5c751c2e95f77a6f5db4d941fc8d85ba288af7ebf275e8c5e2aaa38bd29eaac9e3a195cf9d4dd60ce90b8dee4b8999744daf74df25a198f8c26f88d638963

Download Submit
memory/652-78-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/652-74-0x0000000000000000-mapping.dmp

Download
memory/1120-61-0x0000000000000000-mapping.dmp

Download
memory/1452-57-0x0000000000000000-mapping.dmp

Download
memory/1452-70-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1452-71-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1932-55-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1932-62-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1932-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/2044-72-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2044-65-0x0000000000000000-mapping.dmp

Download
memory/2044-77-0x00000000035C0000-0x00000000036FE000-memory.dmp

Filesize
1.2MB

Download
memory/2044-69-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download