Analysis
-
max time kernel
150s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:01
Static task
static1
Behavioral task
behavioral1
Sample
MV ARM TBN - VESSEL PARTICULARS.exe
Resource
win7-20221111-en
General
-
Target
MV ARM TBN - VESSEL PARTICULARS.exe
-
Size
247KB
-
MD5
6d0fd8a2f7410163581e6013d06336bf
-
SHA1
28a2160869dce2cb8623877c6beafa82f019fe37
-
SHA256
3ab9378862ed7e3a174d4b022ed8b38eb0838d24ea2b6543be055552633e50b9
-
SHA512
636bbc44ac34ebe539c9b269d3ef285b99c9da1a47ba8a188da8c848c6f5473f58ec4689bd76cba09eee46104b1e3e323a876c01b392b0ec9ebc7e37a3138853
-
SSDEEP
6144:UYMY+RpZxFZ8Es0cDemuioWg4Dh9KUax4UK3se6Yt+vp57aXrQKBwH:yosUlN36EqkJ8
Malware Config
Extracted
formbook
ermr
ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=
qNSdDhu/PT/1fgafDagiCSZH1SY=
wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=
jSxRvptHkeTGl7PT0SEmaZmjqzanuA==
b91oL+2wCcpyhnd6yvF6Pg==
mr81yp1/qqZX
hy7Xsz/PU/LWHMcGL4UYJx9n3A==
KlwrHt1gouPaXaWhoQ==
ng8M320IRJL9Ptw=
8GQbOXuaWxvKnNM=
XndOL7E5sNpVUNty4d/a
rryPBBC8PybYb+2h2MF3FHGL
kEoeyERSVCYO0g==
5/P+SBDby5hO
1fYXc30/h9W7iO17
34X+YKR+wRFE
8ir/X2MlVByh5lQ1ow8=
u9ikm2UMZ7J7hpCYow==
FLI+c3clp1BNDjVAfvC2Dnw=
t21Erq8/r09wAzAJTAH3Ng==
VAg3gU1KH9uW3YIPAgc=
Gjlc09d6qurdLePSLZktDmGA1A==
MMraOD3ve5odaf+03cB3FHGL
mLRTTAycMcrHgomShQHVwfFKkGQaehvF
fpab65mlchvKnNM=
M6jUQU0omipqaUNXyvF6Pg==
S/XrNQGVvwUsSnKFyvF6Pg==
LeC0GeF2zvCosNtMx5RltjCD
Y+IGYC/XHS63wIus5n08ADN2qzanuA==
3tJus7Rc6OtWnx9y4d/a
4uSOYiXhGxumZcTLuA==
5PyP2thOiIucXaWhoQ==
6978Rw3FNTibYVQ1ow8=
3Ah90lcSVCYO0g==
V/UQWRsOOQjDye9m0cLQ
yRXcMfySzTmEhddhqljeGH8=
vWuKFZKZ48E=
8+UEda631IpZ
LUofBqVNdT/v+MXiEWm90Ape3g==
NCi29RHdDYd7hso=
i36jBdNko/HyUKg1eWYgJx9n3A==
vdblMhHYSkgDmBly4d/a
oQmZH6K31IpZ
fCBHqaFGx9OUMMuBr5GWDXXY5DAT
FDXweHcHVCYO0g==
qSQd9bd7BQavQ9NbcUT+O6e4OGsaehvF
vN98englU4HHzqi36ju/91SJ
prTUIBi6MhiXZFQ1ow8=
w008jVXdCYd7hso=
p1kghFnjD9iADog5cVDmvrDiTjk=
xLjHJFYDQL+ysdk=
6tiR9MZa9xSMXVQ1ow8=
WMzXJPGcyIrP2g==
SeI4PsQ+N/O0iMs=
+4o0lKRDsz+RUqpoBvt3FHGL
AHQG4ZsybzCo8ZlBs1jeGH8=
kIgR46ls4wiGUJZLtFjeGH8=
b/fmPTHIRhvKnNM=
lTL5XnA4eKLb4snpHXt2s/MaSVsHBrU=
psOQcAKjHxyFw0vIwrZ3FHGL
F806xNnby5hO
7t72ZXkhmSAc8xLYD4J2XXc=
Ihmk3OR96/2HSbdi
ea/NKy3VVcx7hpCYow==
ifair.ltd
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MV ARM TBN - VESSEL PARTICULARS.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation MV ARM TBN - VESSEL PARTICULARS.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exeMV ARM TBN - VESSEL PARTICULARS.exeipconfig.exedescription pid process target process PID 1912 set thread context of 4232 1912 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 4232 set thread context of 2584 4232 MV ARM TBN - VESSEL PARTICULARS.exe Explorer.EXE PID 4232 set thread context of 2584 4232 MV ARM TBN - VESSEL PARTICULARS.exe Explorer.EXE PID 2628 set thread context of 2584 2628 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 2628 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exeipconfig.exepid process 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe 2628 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2584 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exeipconfig.exepid process 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 4232 MV ARM TBN - VESSEL PARTICULARS.exe 2628 ipconfig.exe 2628 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exeipconfig.exedescription pid process Token: SeDebugPrivilege 4232 MV ARM TBN - VESSEL PARTICULARS.exe Token: SeDebugPrivilege 2628 ipconfig.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
MV ARM TBN - VESSEL PARTICULARS.exeExplorer.EXEMV ARM TBN - VESSEL PARTICULARS.exeipconfig.exedescription pid process target process PID 1912 wrote to memory of 4232 1912 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1912 wrote to memory of 4232 1912 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1912 wrote to memory of 4232 1912 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1912 wrote to memory of 4232 1912 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1912 wrote to memory of 4232 1912 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 1912 wrote to memory of 4232 1912 MV ARM TBN - VESSEL PARTICULARS.exe MV ARM TBN - VESSEL PARTICULARS.exe PID 2584 wrote to memory of 4568 2584 Explorer.EXE msiexec.exe PID 2584 wrote to memory of 4568 2584 Explorer.EXE msiexec.exe PID 2584 wrote to memory of 4568 2584 Explorer.EXE msiexec.exe PID 4232 wrote to memory of 2628 4232 MV ARM TBN - VESSEL PARTICULARS.exe ipconfig.exe PID 4232 wrote to memory of 2628 4232 MV ARM TBN - VESSEL PARTICULARS.exe ipconfig.exe PID 4232 wrote to memory of 2628 4232 MV ARM TBN - VESSEL PARTICULARS.exe ipconfig.exe PID 2628 wrote to memory of 3748 2628 ipconfig.exe cmd.exe PID 2628 wrote to memory of 3748 2628 ipconfig.exe cmd.exe PID 2628 wrote to memory of 3748 2628 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"4⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MV ARM TBN - VESSEL PARTICULARS.exe"5⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1912-133-0x0000000005750000-0x0000000005CF4000-memory.dmpFilesize
5.6MB
-
memory/1912-134-0x0000000005210000-0x0000000005276000-memory.dmpFilesize
408KB
-
memory/1912-132-0x0000000000810000-0x0000000000854000-memory.dmpFilesize
272KB
-
memory/2584-143-0x0000000002A40000-0x0000000002B1B000-memory.dmpFilesize
876KB
-
memory/2584-153-0x00000000081C0000-0x00000000082C6000-memory.dmpFilesize
1.0MB
-
memory/2584-152-0x00000000081C0000-0x00000000082C6000-memory.dmpFilesize
1.0MB
-
memory/2584-140-0x0000000007C90000-0x0000000007DB2000-memory.dmpFilesize
1.1MB
-
memory/2628-148-0x0000000001920000-0x0000000001C6A000-memory.dmpFilesize
3.3MB
-
memory/2628-150-0x0000000000F80000-0x0000000000FAD000-memory.dmpFilesize
180KB
-
memory/2628-151-0x0000000001780000-0x0000000001810000-memory.dmpFilesize
576KB
-
memory/2628-147-0x0000000000F80000-0x0000000000FAD000-memory.dmpFilesize
180KB
-
memory/2628-146-0x00000000008E0000-0x00000000008EB000-memory.dmpFilesize
44KB
-
memory/2628-145-0x0000000000000000-mapping.dmp
-
memory/3748-149-0x0000000000000000-mapping.dmp
-
memory/4232-144-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4232-139-0x00000000014C0000-0x00000000014D1000-memory.dmpFilesize
68KB
-
memory/4232-138-0x0000000001150000-0x000000000149A000-memory.dmpFilesize
3.3MB
-
memory/4232-141-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4232-142-0x0000000002DC0000-0x0000000002DD1000-memory.dmpFilesize
68KB
-
memory/4232-136-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4232-135-0x0000000000000000-mapping.dmp