Analysis
-
max time kernel
173s -
max time network
201s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
18-11-2022 22:42
Static task
static1
Behavioral task
behavioral1
Sample
IyEXXDHLEU4cBtq.exe
Resource
win7-20221111-en
General
-
Target
IyEXXDHLEU4cBtq.exe
-
Size
721KB
-
MD5
0dd734598701e5ba50d5596a42b8d94c
-
SHA1
d6cf2163dd892eb8c5e274856c61e9f90b03d1d9
-
SHA256
501d6ddc2677cf909cdf85570bfbf09099004a108236bb25954758387f080b9f
-
SHA512
d22bf5d34170f274883346349b3093d90d15a5769e9d6a1a7fb75e6230b9bce373af1f7601d40c19aa34551bbcbc08170cae464651525bdc02d418efd378c745
-
SSDEEP
12288:yxBnM33302IgFJN0V3foFtswOSf5nHoHY8up3wxb4xZ2cbTEcjZnbCkI:YBnG30YComSxEY8gwxED2SBjZnbCkI
Malware Config
Extracted
formbook
bmr1
q05YNsJC4MpYLGAf4A==
6KUzKCvwX0fwzrFQXvlucw==
KA4ZibW1w+hWN5Q=
TfgNq18tIWtsM7h+DexncQ==
zspNqjUKBdJVHTkiMMXJYeF7G53bVvMPoA==
hopQr+b8KzPIbMWvw0Yxir6cyw==
2thmt+17FR/MVsakbM/+w3xGOhopJw==
5gO5gfA6jwna/4FNSPqrvvHyr2A=
kqtr0wr9KaOXVMyDDexncQ==
PNldyz0Boa5cLGAf4A==
Gysor7fqabd0UzTwWp3Zir6cyw==
pMRgV18gtLorB21prX4=
ukpf+vu2u+hWN5Q=
pcS/rO+KmPMj69G9cMHnoSEm59cbIQ==
4fWGzv347bFNDYJeeIHKG5co
WXlRyM2Yn+4Ab1EgRAFHWdGDCzf1
ZPoM+2U1cwMzteOBsHY=
o8jQoNron4sT3A/KomE=
7QX8tTpv/A+YKw==
wFvmV8SY/A+YKw==
95ZJuruBovPziXkgyca4
DMhVqQXTdWLZcWM3IVNtZg==
Fya6G31VF/eHQ+OBsHY=
Q1AMfbPC2yU1IZV9q4C8vvHyr2A=
fRtdZZssSsG3s6Z7
bxBFLS8FnGv/bdOdDdjmfHz9ww==
0YG+jc1b/A+YKw==
lRliT3IEEDJ4ZoZ8a+7meQ==
dI7SuWbu40M=
Z4oXeMBk6sdDMow=
h5BX2BodM4ChJyEJXWhZEIlmBBTw
cYNHnMHSDHNoFn5XDexncQ==
U4uXeMXGel/Yo5F7JWy7ir6cyw==
w30JX9IHAfmEUkjMfJSh
nyYeAHdAO4ibDfK6+QoHkxDjQ0L/
kRNHMSv9qT1YAOi+/YTEubWayQ==
K84SAQbaiIE2JhEBwkI87fHyr2A=
/TfyyBrkRXG3s6Z7
Xm4DxD9z/A+YKw==
Iiod8GDRqTNm
UQavJOBL1PauNg==
5gHqohpY/A+YKw==
p9NjrOfd7y00suOBsHY=
+QwD0hEcmOH9FrqKOoip
t1ynrb95ITDbVcCcYLbyyYAhz/aC86DP
nsJ4j550C9tdGUvpa9jieQ==
2UyPicBXYsG3s6Z7
JcXRsh7oFKPHNx7+VFi2w/Hyr2A=
3AT+4Rqw0TI3s+OBsHY=
0m73TYSQvcdyP7Khu0w87fHyr2A=
0tyaI3KOu9UtnY5MWuNVKWo=
SXV//PAYkeL6tJB6LnC7ir6cyw==
BZ3ZnFfRqTNm
DIiVdbFCcAQd/3FWhBPOSNDjQ0L/
PzqDVoWG2r6rM5N9histir6cyw==
QFxDG5iTNsm3s6Z7
K07iK1LZc1POTrmDDexncQ==
1WJ3D0tnnQICtizlgdNO55Ii
Y3YBWZCixOhWN5Q=
N1AaNH32m3YaLGAf4A==
2wYTDEnS7XWxVTvMfJSh
Um9jMnNrA+BtRUDMfJSh
8eqyDgzQxuhWN5Q=
JbnNV71HXsW3s6Z7
escortsforme.com
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
cscript.exeflow pid process 7 676 cscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IyEXXDHLEU4cBtq.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation IyEXXDHLEU4cBtq.exe -
Loads dropped DLL 1 IoCs
Processes:
cscript.exepid process 676 cscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
IyEXXDHLEU4cBtq.exeIyEXXDHLEU4cBtq.execscript.exedescription pid process target process PID 1756 set thread context of 360 1756 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 360 set thread context of 1268 360 IyEXXDHLEU4cBtq.exe Explorer.EXE PID 676 set thread context of 1268 676 cscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
cscript.exedescription ioc process Key created \Registry\User\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
IyEXXDHLEU4cBtq.execscript.exepid process 360 IyEXXDHLEU4cBtq.exe 360 IyEXXDHLEU4cBtq.exe 360 IyEXXDHLEU4cBtq.exe 360 IyEXXDHLEU4cBtq.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
IyEXXDHLEU4cBtq.execscript.exepid process 360 IyEXXDHLEU4cBtq.exe 360 IyEXXDHLEU4cBtq.exe 360 IyEXXDHLEU4cBtq.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe 676 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
IyEXXDHLEU4cBtq.execscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 360 IyEXXDHLEU4cBtq.exe Token: SeDebugPrivilege 676 cscript.exe Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
IyEXXDHLEU4cBtq.exeExplorer.EXEcscript.exedescription pid process target process PID 1756 wrote to memory of 360 1756 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 1756 wrote to memory of 360 1756 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 1756 wrote to memory of 360 1756 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 1756 wrote to memory of 360 1756 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 1756 wrote to memory of 360 1756 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 1756 wrote to memory of 360 1756 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 1756 wrote to memory of 360 1756 IyEXXDHLEU4cBtq.exe IyEXXDHLEU4cBtq.exe PID 1268 wrote to memory of 676 1268 Explorer.EXE cscript.exe PID 1268 wrote to memory of 676 1268 Explorer.EXE cscript.exe PID 1268 wrote to memory of 676 1268 Explorer.EXE cscript.exe PID 1268 wrote to memory of 676 1268 Explorer.EXE cscript.exe PID 676 wrote to memory of 1528 676 cscript.exe Firefox.exe PID 676 wrote to memory of 1528 676 cscript.exe Firefox.exe PID 676 wrote to memory of 1528 676 cscript.exe Firefox.exe PID 676 wrote to memory of 1528 676 cscript.exe Firefox.exe PID 676 wrote to memory of 1528 676 cscript.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IyEXXDHLEU4cBtq.exe"C:\Users\Admin\AppData\Local\Temp\IyEXXDHLEU4cBtq.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IyEXXDHLEU4cBtq.exe"C:\Users\Admin\AppData\Local\Temp\IyEXXDHLEU4cBtq.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
804KB
MD5b09588d000ef4bf2a3dddd85bd701423
SHA144a810ff8920a340a30b66d932253555143dc28b
SHA256ce4ffc1a12150b8523378553f2a97dd3fc44d5210ae6c296ab31e2c78f0d03c3
SHA5121d807d92da34ccba4628f2a55c3ac1c03ff63925d79e266b4e52d71002228cbde76206ec696c3e25143fc2e0cab56589155666ff6f8ea0ebfd5ebcd362168e2a
-
memory/360-69-0x00000000008C0000-0x0000000000BC3000-memory.dmpFilesize
3.0MB
-
memory/360-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/360-68-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/360-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/360-70-0x00000000001A0000-0x00000000001B0000-memory.dmpFilesize
64KB
-
memory/360-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/360-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/360-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/360-64-0x00000000004012B0-mapping.dmp
-
memory/676-78-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/676-76-0x0000000001DE0000-0x0000000001E6F000-memory.dmpFilesize
572KB
-
memory/676-75-0x00000000020B0000-0x00000000023B3000-memory.dmpFilesize
3.0MB
-
memory/676-73-0x0000000000310000-0x0000000000332000-memory.dmpFilesize
136KB
-
memory/676-74-0x0000000000070000-0x000000000009D000-memory.dmpFilesize
180KB
-
memory/676-72-0x0000000000000000-mapping.dmp
-
memory/1268-71-0x0000000006B20000-0x0000000006C7E000-memory.dmpFilesize
1.4MB
-
memory/1268-77-0x0000000004B70000-0x0000000004CB7000-memory.dmpFilesize
1.3MB
-
memory/1268-80-0x0000000004B70000-0x0000000004CB7000-memory.dmpFilesize
1.3MB
-
memory/1756-58-0x0000000005E40000-0x0000000005EB0000-memory.dmpFilesize
448KB
-
memory/1756-59-0x0000000000AA0000-0x0000000000AD6000-memory.dmpFilesize
216KB
-
memory/1756-56-0x00000000003E0000-0x00000000003F8000-memory.dmpFilesize
96KB
-
memory/1756-55-0x0000000075C11000-0x0000000075C13000-memory.dmpFilesize
8KB
-
memory/1756-54-0x0000000000CA0000-0x0000000000D5A000-memory.dmpFilesize
744KB
-
memory/1756-57-0x00000000003C0000-0x00000000003CC000-memory.dmpFilesize
48KB