Analysis
- max time kernel
65s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2022, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
General
- Target file.exe
- Size 5.6MB
- Sample221019-tmc2gsfdfr
- SHA256 203f591e084a2ece60b2be5c13fbafa673ecac10ef91055ad7bd73fddc656b5d
- MD5 74cffc19a09979e23bfd9f5a5378508b
- SHA1 54e1969a3f4000a610aec127bf2d9028e0dc7588
- SHA512 be1aa3e40639201f9f5eb6a476ac8a4ca8381eb92c116f4b472d661e435b2b4115337879b59caec4ee397df0adaba5011054cfb425eb9978e82bdb1dea9aaae5
- SSDEEP 98304:cdqxlydvAURQUc6QSiSbgOOzVbRRtYoa5JSY8ANYCfBeGO:cdkqAURQUc6QSgOOnA7lhBo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2260 relaunch_app.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation file.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe 2260 relaunch_app.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2260 relaunch_app.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4632 wrote to memory of 2260 4632 file.exe 82 PID 4632 wrote to memory of 2260 4632 file.exe 82 PID 4632 wrote to memory of 2260 4632 file.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Public\Documents\relaunch_app.exe"C:\Users\Public\Documents\relaunch_app.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\Documents\relaunch_app.exe
- Size 5.4MB
- SHA256 1a4c9e4b1dc160bcaa56f915f07cccc84f61111b04219a075a7091cf3808bfc1
- MD5 161d5ccdf1f7563e92d36ad1d5492ccc
- SHA1 f7a40d9eaf5fb2278c4f7d317af52adcb3ebbdc9
- SHA512 a81f40173cf1dec0c8ce28e91f878493e6494e8a88de13637026a7eae4948232708033c80f26240dc52b6988575717a93a0805740fcd7e5a4a7ccd3b8084faa1
- SSDEEP 49152:6tSHkCyvh0uhRLTxd+K7EIrbgGCpLXadU/8IrOZHZVRcfM62d7Ep4W/61jn+E0tE:65veub/x6ebgGCpLXSRZ0xsx97Du
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Public\Documents\relaunch_app.exe
- Size 5.4MB
- SHA256 1a4c9e4b1dc160bcaa56f915f07cccc84f61111b04219a075a7091cf3808bfc1
- MD5 161d5ccdf1f7563e92d36ad1d5492ccc
- SHA1 f7a40d9eaf5fb2278c4f7d317af52adcb3ebbdc9
- SHA512 a81f40173cf1dec0c8ce28e91f878493e6494e8a88de13637026a7eae4948232708033c80f26240dc52b6988575717a93a0805740fcd7e5a4a7ccd3b8084faa1
- SSDEEP 49152:6tSHkCyvh0uhRLTxd+K7EIrbgGCpLXadU/8IrOZHZVRcfM62d7Ep4W/61jn+E0tE:65veub/x6ebgGCpLXSRZ0xsx97Du
- MD5 SHA1 SHA512 SSDEEP