Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2022, 05:36
Behavioral task
behavioral1
Sample
2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe
-
Size
73KB
-
MD5
94e2647ed5d46dca9532791b6565f063
-
SHA1
1f14ed356a5b83f86bd821a99f150a24793a5ab0
-
SHA256
2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455
-
SHA512
6d50c0a7abfeca8f10fdfe21aadd4b6432847ed0225b1649cf74d676bf80841e4e8cab7c2cff15082e04b4e0afa8fb13ca8965192588b254cfbf13adc0fc3495
-
SSDEEP
1536:sgSeGDjtQhnwmmB0yjMqqUM2mr3IdE8mne0Avu5r++yy7CA7GcIaapavdv:sMSjOnrmBbMqqMmr3IdE8we0Avu5r++N
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vvnbepjzcvk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe" 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\E: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\I: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\L: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\N: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\U: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\X: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\A: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\F: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\G: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\M: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\R: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\S: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\T: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\V: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\Z: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\H: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\J: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\K: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\O: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\Q: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\W: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\P: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe File opened (read-only) \??\Y: 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 3116 wrote to memory of 5012 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 83 PID 3116 wrote to memory of 5012 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 83 PID 3116 wrote to memory of 5012 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 83 PID 3116 wrote to memory of 3656 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 89 PID 3116 wrote to memory of 3656 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 89 PID 3116 wrote to memory of 3656 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 89 PID 3116 wrote to memory of 2516 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 91 PID 3116 wrote to memory of 2516 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 91 PID 3116 wrote to memory of 2516 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 91 PID 3116 wrote to memory of 4936 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 94 PID 3116 wrote to memory of 4936 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 94 PID 3116 wrote to memory of 4936 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 94 PID 3116 wrote to memory of 2432 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 96 PID 3116 wrote to memory of 2432 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 96 PID 3116 wrote to memory of 2432 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 96 PID 3116 wrote to memory of 3460 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 98 PID 3116 wrote to memory of 3460 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 98 PID 3116 wrote to memory of 3460 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 98 PID 3116 wrote to memory of 1328 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 100 PID 3116 wrote to memory of 1328 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 100 PID 3116 wrote to memory of 1328 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 100 PID 3116 wrote to memory of 2604 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 102 PID 3116 wrote to memory of 2604 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 102 PID 3116 wrote to memory of 2604 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 102 PID 3116 wrote to memory of 2308 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 104 PID 3116 wrote to memory of 2308 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 104 PID 3116 wrote to memory of 2308 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 104 PID 3116 wrote to memory of 1964 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 106 PID 3116 wrote to memory of 1964 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 106 PID 3116 wrote to memory of 1964 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 106 PID 3116 wrote to memory of 2880 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 108 PID 3116 wrote to memory of 2880 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 108 PID 3116 wrote to memory of 2880 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 108 PID 3116 wrote to memory of 2224 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 110 PID 3116 wrote to memory of 2224 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 110 PID 3116 wrote to memory of 2224 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 110 PID 3116 wrote to memory of 4376 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 112 PID 3116 wrote to memory of 4376 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 112 PID 3116 wrote to memory of 4376 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 112 PID 3116 wrote to memory of 2960 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 114 PID 3116 wrote to memory of 2960 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 114 PID 3116 wrote to memory of 2960 3116 2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe"C:\Users\Admin\AppData\Local\Temp\2bed188928c62dcd3169bdb73f810517c56d00100878ff788fd8f314da4de455.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:5012
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:3656
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2516
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4936
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2432
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:3460
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1328
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2604
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2308
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:1964
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2880
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵PID:2224
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵PID:4376
-
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵PID:2960
-