Analysis
-
max time kernel
134s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2022 11:54
Static task
static1
Behavioral task
behavioral1
Sample
f183d934a954fc80602a9173f55f22c9.exe
Resource
win7-20220812-en
General
-
Target
f183d934a954fc80602a9173f55f22c9.exe
-
Size
850KB
-
MD5
f183d934a954fc80602a9173f55f22c9
-
SHA1
a472c526f1dec0eb9bccdf2e083171a176faf1c4
-
SHA256
95de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57
-
SHA512
48d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24
-
SSDEEP
12288:jYmzPxoepv5EUOPri4BTVUDnV89SxP3ol8VU9o:/xoS6TjUDnlP3G9o
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=finarnw
D5c27bWU8dvgdayPUMzKbc75CmsD9aUSDw
r4RkKWPKszhkZVTtXGBDNyrzcDPjpcnGNp
0xC4b495c6ef4B61d5757a1e78dE22edC315867C84
XshLZA5C9odmaiEfopX5DYvwMbnM4hqCME
TT7mceJ6BNhTPFqpaBy1ND1CWGwaGeqhpx
t1MrxfTEGEZioK7qjcDd48KVC5BMk7ccH8B
GCM62OODIUXHYPTVUZT2W4GKPIO7YMLZDNPR4NGUWLBU7KPOU7Q7E44X
48Zvk6W9kfXik8CEscQYjEZdDCVZtXNEGdjczTR4XD9SKfLWkirntGLR7UyhD7aas3C2N3QefcdB4gyLZt93CrmtP5WAeqJ
qz448vxrv9y6lsy0l4y6x98gylykleumxqnqs7fkn6
1AvqxpSfuNooDv2gn8rFNXiWP64bn7m8xa
0x7374d06666974119Fb6C8c1F10D4Ab7eCB724Fcd
LKcXMo6X6jGyk9o9phn4YvYUQ8QVR4wJgo
ronin:bb375c985bc63d448b3bc14cda06b2866f75e342
+79889916188
+79889916188
+79889916188
MJfnNkoXewo8QB5iu9dee2exwdavDxWRLC
ltc1q309prv3k8lc9gqd062eevjvxmkgyv00xe3m6jg
3Gs18Dq8SNrs3kLQdrpUFHa2yX8uD9ZXR7
bc1qhcynpwvj6lvdh393ph8tesk0mljsc6z3y40h2m
89PjhdrngYjeSa8dFeg6q8Sz4BXdrLLP8H8z82eUhTNjPBpTYkr3o6fWnkqng9D5TRaPT4HafXwUTJqcPE8SsbHUK5PM2Qx
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MoUSO.exepid process 2628 MoUSO.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f183d934a954fc80602a9173f55f22c9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation f183d934a954fc80602a9173f55f22c9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f183d934a954fc80602a9173f55f22c9.exedescription pid process target process PID 2536 set thread context of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
f183d934a954fc80602a9173f55f22c9.exeMoUSO.exepid process 2536 f183d934a954fc80602a9173f55f22c9.exe 2536 f183d934a954fc80602a9173f55f22c9.exe 2536 f183d934a954fc80602a9173f55f22c9.exe 2628 MoUSO.exe 2628 MoUSO.exe 2628 MoUSO.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f183d934a954fc80602a9173f55f22c9.exeMoUSO.exedescription pid process Token: SeDebugPrivilege 2536 f183d934a954fc80602a9173f55f22c9.exe Token: SeDebugPrivilege 2628 MoUSO.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
f183d934a954fc80602a9173f55f22c9.exef183d934a954fc80602a9173f55f22c9.exeMoUSO.exedescription pid process target process PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 2536 wrote to memory of 856 2536 f183d934a954fc80602a9173f55f22c9.exe f183d934a954fc80602a9173f55f22c9.exe PID 856 wrote to memory of 1256 856 f183d934a954fc80602a9173f55f22c9.exe schtasks.exe PID 856 wrote to memory of 1256 856 f183d934a954fc80602a9173f55f22c9.exe schtasks.exe PID 856 wrote to memory of 1256 856 f183d934a954fc80602a9173f55f22c9.exe schtasks.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe PID 2628 wrote to memory of 4508 2628 MoUSO.exe MoUSO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f183d934a954fc80602a9173f55f22c9.exe"C:\Users\Admin\AppData\Local\Temp\f183d934a954fc80602a9173f55f22c9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f183d934a954fc80602a9173f55f22c9.exe"C:\Users\Admin\AppData\Local\Temp\f183d934a954fc80602a9173f55f22c9.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /TN Cache-S-21-2946144819-3e21f723 /TR "C:\Users\Admin\AppData\Local\cache\MoUSO.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeC:\Users\Admin\AppData\Local\cache\MoUSO.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exe"C:\Users\Admin\AppData\Local\cache\MoUSO.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeFilesize
850KB
MD5f183d934a954fc80602a9173f55f22c9
SHA1a472c526f1dec0eb9bccdf2e083171a176faf1c4
SHA25695de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57
SHA51248d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24
-
C:\Users\Admin\AppData\Local\cache\MoUSO.exeFilesize
850KB
MD5f183d934a954fc80602a9173f55f22c9
SHA1a472c526f1dec0eb9bccdf2e083171a176faf1c4
SHA25695de56b7b27bfdfae1c741a5f02a42d1a4f7a23286ca8b292e85132b8b87bb57
SHA51248d42d3c6ca44944ea6879bb5c6367e5c03b938648f9667f235815acb02aa8191e02ca840acc855bf83b9ed0945a5516bb6c4433e7859efafb58b4b18b92ef24
-
memory/856-140-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/856-141-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/856-143-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/856-137-0x0000000000000000-mapping.dmp
-
memory/856-138-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/856-139-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1256-142-0x0000000000000000-mapping.dmp
-
memory/2536-132-0x0000000000CD0000-0x0000000000DAA000-memory.dmpFilesize
872KB
-
memory/2536-135-0x0000000005EF0000-0x0000000005F82000-memory.dmpFilesize
584KB
-
memory/2536-136-0x0000000005EE0000-0x0000000005EEA000-memory.dmpFilesize
40KB
-
memory/2536-134-0x00000000062B0000-0x0000000006854000-memory.dmpFilesize
5.6MB
-
memory/2536-133-0x0000000004FF0000-0x000000000508C000-memory.dmpFilesize
624KB
-
memory/2628-146-0x0000000000710000-0x00000000007EA000-memory.dmpFilesize
872KB
-
memory/4508-147-0x0000000000000000-mapping.dmp