Analysis
- max time kernel
303s - max time network
306s - platform
windows10-2004_x64 - resource
win10v2004-20220812-es - resource tags
arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows - submitted
18/10/2022, 19:10
Static task
static1
Behavioral task
behavioral1
Sample
dabarrientos-gpiePk.exe
Resource
win7-20220901-es
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral2
Sample
dabarrientos-gpiePk.exe
Resource
win10v2004-20220812-es
windows10-2004-x64
9 signatures
300 seconds
General
- Target dabarrientos-gpiePk.exe
- Size 271.0MB
- Sample221018-xvbeeadah2
- SHA256 8a8a98cdd8a8c869902c05f6c09d5fe0a268cd102f99d88c2923179ea4fce051
- MD5 efe40ef11122d65d5a43ee95df0e3cd7
- SHA1 e92f342c4162f1b9df59587ad974e5da4a4fb20a
- SHA512 858195481c9e6a07c45257cdd6eb417fedb393804cc5a5ae2eccc0f2b5e6f52d2a423d021299b69ac64fef783b8484cb74a095fce48ac6aa8b5f2588a5ba5653
- SSDEEP 49152:qZb6wBQbWbZ3tVS7yT5bv+xW9lFDMe8KFgTeP0a2HVqdEKjNvoqmzs6EOAT3wc/7:cbnSWbuGlFDMhKFgTePcdKjNxHkzC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4584 AsusDrivcylvJOzhmQp.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation dabarrientos-gpiePk.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run AsusDrivcylvJOzhmQp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AsusDisplayCtrl1953N = "C:\\ProgramData\\AsusDrivjMKIBos\\AsusDrivcylvJOzhmQp.exe" AsusDrivcylvJOzhmQp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AsusDisplayCtrl23H71EN13 = "cmd.exe /c start C:\\ProgramData\\AsusDrivjMKIBos\\AsusDrivcylvJOzhmQp.exe" AsusDrivcylvJOzhmQp.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 49 ipinfo.io - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe 4884 dabarrientos-gpiePk.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe Token: SeIncBasePriorityPrivilege 4584 AsusDrivcylvJOzhmQp.exe Token: 33 4584 AsusDrivcylvJOzhmQp.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4884 wrote to memory of 4584 4884 dabarrientos-gpiePk.exe 90 PID 4884 wrote to memory of 4584 4884 dabarrientos-gpiePk.exe 90 PID 4884 wrote to memory of 4584 4884 dabarrientos-gpiePk.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\dabarrientos-gpiePk.exe"C:\Users\Admin\AppData\Local\Temp\dabarrientos-gpiePk.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\ProgramData\AsusDrivjMKIBos\AsusDrivcylvJOzhmQp.exe"C:\ProgramData\AsusDrivjMKIBos\AsusDrivcylvJOzhmQp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\AsusDrivjMKIBos\AsusDrivcylvJOzhmQp.exe
- Size 406.5MB
- SHA256 7bfd6125e5bd1fdea0541019813490dd98e83aa9105142eff06fc082e12e18ab
- MD5 9b1885454ceb30d569f01b6eb485fb99
- SHA1 fd38591e9ad3643a3bc5b58a61d059f86f0ac042
- SHA512 71ecf1b603b2e714c9c18a3503656c36bf575dcce6d25b64e7b1be1860b8a462d3d86b88df096cadc4249b406aecaa671fbb31ec4ba3dd7ff3594884dc83b854
- SSDEEP 196608:Ikx6WvnGNMVJ/gaCbo8XrX6Onge3FLspe3rd5+GXfeS:Ik1nGE/gtbgedGe3rdMG1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\AsusDrivjMKIBos\AsusDrivcylvJOzhmQp.exe
- Size 406.5MB
- SHA256 7bfd6125e5bd1fdea0541019813490dd98e83aa9105142eff06fc082e12e18ab
- MD5 9b1885454ceb30d569f01b6eb485fb99
- SHA1 fd38591e9ad3643a3bc5b58a61d059f86f0ac042
- SHA512 71ecf1b603b2e714c9c18a3503656c36bf575dcce6d25b64e7b1be1860b8a462d3d86b88df096cadc4249b406aecaa671fbb31ec4ba3dd7ff3594884dc83b854
- SSDEEP 196608:Ikx6WvnGNMVJ/gaCbo8XrX6Onge3FLspe3rd5+GXfeS:Ik1nGE/gtbgedGe3rdMG1
- MD5 SHA1 SHA512 SSDEEP