98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e

General

Target

98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe
Size

241KB
MD5

ea232ec38c6d1a6fc26e409c22ad04bf
SHA1

7d746b5c4c895f06d3225edfa688214077a63482
SHA256

98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e
SHA512

56164a8a86b48d10ca7407bfbc8f53880cf8431cc6425b1c4c85bb3278f2cd01a111ab3e2f3e897877958b47a9c74e33fa7b91f8ee7a46cf052327ec2541ae81
SSDEEP

6144:zZXBsWqsE/Ao+mv8Qv0LVmwq4FU0nN876NKxIIkij:lXmwRo+mv8QD4+0N46NKxIY

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

17 3144 WScript.exe
Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe

flow	pid	process
17	3144	WScript.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

Processes:

98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Insata\Ikars\sanodo.vbs	98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe
File opened for modification	C:\Program Files (x86)\Insata\Ikars\albur.bat	98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe
File opened for modification	C:\Program Files (x86)\Insata\Ikars\1.txt	98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe
File opened for modification	C:\Program Files (x86)\Insata\Ikars\Uninstall.exe	98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe
File created	C:\Program Files (x86)\Insata\Ikars\Uninstall.ini	98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.execmd.exe

description	pid	process	target process
PID 4808 wrote to memory of 2276	4808	98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe	cmd.exe
PID 4808 wrote to memory of 2276	4808	98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe	cmd.exe
PID 4808 wrote to memory of 2276	4808	98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe	cmd.exe
PID 2276 wrote to memory of 3144	2276	cmd.exe	WScript.exe
PID 2276 wrote to memory of 3144	2276	cmd.exe	WScript.exe
PID 2276 wrote to memory of 3144	2276	cmd.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe
"C:\Users\Admin\AppData\Local\Temp\98ddefb43cc45f53b1286cce109c91efda259a4e0e6681510f11989fec320b9e.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Insata\Ikars\albur.bat" "
2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Insata\Ikars\sanodo.vbs"
3⤵
- Blocklisted process makes network request
PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Insata\Ikars\1.txt

Filesize
27B

MD5
213c0742081a9007c9093a01760f9f8c

SHA1
df53bb518c732df777b5ce19fc7c02dcb2f9d81b

SHA256
9681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69

SHA512
55182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9

Download Submit
C:\Program Files (x86)\Insata\Ikars\albur.bat

Filesize
1009B

MD5
b72eec07f49ca5f55d9dd2b0203fd8d6

SHA1
844a4c6bacd822767ae55b9cf1fffa0f6f187046

SHA256
213977269cb831de49d6b39d3554ae1369dcf8ffd7ad8179e19f249be5ca395c

SHA512
07ddf65060e4955f00956a8234c89836b7a74980100bca87adc6f586a020c86469ab96255a85dfc668490d18df4d53365fbdbdf97c249dbe163819f9bcb9111f

Download Submit
C:\Program Files (x86)\Insata\Ikars\sanodo.vbs

Filesize
184B

MD5
ec2080277330fb8c2a3d58d784cee484

SHA1
31f826302fa167cec67f017d971eb8b0dd543d1a

SHA256
fe519e5c92471e84a96107eb5eb95ae9b1c5add1b83da00dbefbc527594ffc56

SHA512
6b83a6fb9d2ceab091c7e7dd099dc5c8dd918c48ef83f6491a8534577192db995aaf8a839aa898ccf892b9628284b1100b4cde060dae30b48f03b67313d954d9

Download Submit
memory/2276-132-0x0000000000000000-mapping.dmp

Download
memory/3144-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads