Analysis
-
max time kernel
182s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:13
Static task
static1
Behavioral task
behavioral1
Sample
dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe
Resource
win10v2004-20220812-en
General
-
Target
dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe
-
Size
71KB
-
MD5
47fbde733cb95ed3259e8203efafdcc0
-
SHA1
8c065f4b57ead6cb98986fef39b0e52fa76dfab8
-
SHA256
dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88
-
SHA512
8b484e3b430ce6e7dabc65d59864c5a1dd3c49b9cfd3be3e349564f331b05af2caa4e1094b8c6c28315eb7361d360eb75ecbfc35bcbaf0b2a48efc6ba5e9b9ad
-
SSDEEP
1536:AJqTen/QJ97NoqKTKbmVDTaWKkX1HPn9RngXhCN1U0I/c6/a:A/n/QJ97NGaWvlHnn+h61tI/g
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1484-133-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/1484-134-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/1484-136-0x0000000000400000-0x0000000000425000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exepid process 1484 dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe 1484 dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exedescription pid process target process PID 1484 wrote to memory of 2196 1484 dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe cmd.exe PID 1484 wrote to memory of 2196 1484 dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe cmd.exe PID 1484 wrote to memory of 2196 1484 dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe"C:\Users\Admin\AppData\Local\Temp\dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Clj..bat" > nul 2> nul2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Clj..batFilesize
274B
MD58a2df004687610ff4cedbc99a8eeac4c
SHA1554b6546b4532d4c03ae4a11ec1c6209c64e7c16
SHA256d41c20900af92931c9b7595690925eeea03c4cf256e82c97cb21f30b8b7ffb85
SHA51296de5ddd2631efa6a44d3a6c0bb952e4e822512b2f457c1e5388e450ba148f23fb9bc8ba4f5723a32aee3d803bd3aba0048370996f3176345472a28a2eedbac3
-
memory/1484-132-0x00000000005F0000-0x00000000005F4000-memory.dmpFilesize
16KB
-
memory/1484-133-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1484-134-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1484-136-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2196-135-0x0000000000000000-mapping.dmp