Analysis
-
max time kernel
46s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 18:12
Static task
static1
Behavioral task
behavioral1
Sample
20beeb0a82adcce3a58372804acc46be.exe
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
20beeb0a82adcce3a58372804acc46be.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
20beeb0a82adcce3a58372804acc46be.exe
-
Size
400KB
-
MD5
20beeb0a82adcce3a58372804acc46be
-
SHA1
c579d9017d2c8298fe075ff5c05963901330e72a
-
SHA256
d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
-
SHA512
7636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
SSDEEP
3072:sAAdrtFV2GenT0cTtm2LAQSXVqjzpYfJhpw7EHbH0hLNZ:ux2GenQ67wk3pyJhpwkUTZ
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
resource yara_rule behavioral1/memory/1768-55-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 2 IoCs
pid Process 456 Imsossm.exe 240 Imsossm.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\F: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\H: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\N: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\W: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\B: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\I: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\O: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\T: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\Z: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\G: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\L: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\P: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\U: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\X: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\Y: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\J: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\M: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\Q: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\R: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\S: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\V: 20beeb0a82adcce3a58372804acc46be.exe File opened (read-only) \??\K: 20beeb0a82adcce3a58372804acc46be.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Imsossm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Imsossm.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Imsossm.exe 20beeb0a82adcce3a58372804acc46be.exe File opened for modification C:\Program Files (x86)\Imsossm.exe 20beeb0a82adcce3a58372804acc46be.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 20beeb0a82adcce3a58372804acc46be.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 20beeb0a82adcce3a58372804acc46be.exe -
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\WpadDecisionTime = f08861418becd801 Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6 Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\d6-b7-cd-fe-6e-b6 Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6\WpadDecisionTime = f08861418becd801 Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6\WpadDecisionReason = "1" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\WpadDecisionReason = "1" Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6\WpadDecision = "0" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6\WpadDetectedUrl Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\WpadDecision = "0" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\d6-b7-cd-fe-6e-b6 Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5} Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6\WpadDecisionTime = 704c7e4a8becd801 Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\WpadNetworkName = "Network 2" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6 Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6\WpadDecisionReason = "1" Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\WpadNetworkName = "Network 2" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5} Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6\WpadDecisionTime = f08861418becd801 Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\WpadDecisionTime = 704c7e4a8becd801 Imsossm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Imsossm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\WpadDecisionReason = "1" Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{4A72DDFF-71A7-4DEB-BDE0-27C03B1454B5}\WpadDecision = "0" Imsossm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Imsossm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-b7-cd-fe-6e-b6\WpadDecision = "0" Imsossm.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1768 20beeb0a82adcce3a58372804acc46be.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 456 wrote to memory of 240 456 Imsossm.exe 30 PID 456 wrote to memory of 240 456 Imsossm.exe 30 PID 456 wrote to memory of 240 456 Imsossm.exe 30 PID 456 wrote to memory of 240 456 Imsossm.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\20beeb0a82adcce3a58372804acc46be.exe"C:\Users\Admin\AppData\Local\Temp\20beeb0a82adcce3a58372804acc46be.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
C:\Program Files (x86)\Imsossm.exe"C:\Program Files (x86)\Imsossm.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Program Files (x86)\Imsossm.exe"C:\Program Files (x86)\Imsossm.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:240
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
Filesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd
-
Filesize
400KB
MD520beeb0a82adcce3a58372804acc46be
SHA1c579d9017d2c8298fe075ff5c05963901330e72a
SHA256d1aaa7e7d31bf648c57f0c721d6f6ee2b17395b4e09d9d89a4f6dbd5dd706a8e
SHA5127636912ba6323063cefb7fac5a6cff9e44a474e452a4d5d4f77ef88968266de184c68112e3667585e02e811781f51ee020e61ce820e3f9a38dcfdf30e6d522bd