21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da

Analysis

max time kernel
182s
max time network
114s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe
Size

600KB
MD5

46007898edda62aa7e0fc39c57e5fe90
SHA1

7efc2f85849c9b0f0912d22a4b6a7cd48ef0ddc1
SHA256

21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da
SHA512

2d8f84a945b5ca7ff57577709156764b80ee9988f85f77cafbd130643935b729361d60434f8ebcd7d53655bec5c3a09fcaf5c9cd0e89fd4dda47cec0bee82e56
SSDEEP

12288:VHjcoe9PH96vB/fAuBcm9TyOE/xG3muGx44MG4Yx:VDgINfAuBcgcZG2uG24MG4Y

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

ogpoaer.exe~DFA7D.tmphukuder.exe

pid process

1740 ogpoaer.exe
556 ~DFA7D.tmp
552 hukuder.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

760 cmd.exe
Loads dropped DLL 3 IoCs

Processes:

21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exeogpoaer.exe~DFA7D.tmp

pid process

1032 21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe
1740 ogpoaer.exe
556 ~DFA7D.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1740	ogpoaer.exe
556	~DFA7D.tmp
552	hukuder.exe

pid	process
760	cmd.exe

pid	process
1032	21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe
1740	ogpoaer.exe
556	~DFA7D.tmp

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

hukuder.exe

pid	process
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe
552	hukuder.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

~DFA7D.tmp

description pid process

Token: SeDebugPrivilege 556 ~DFA7D.tmp

description	pid	process
Token: SeDebugPrivilege	556	~DFA7D.tmp

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exeogpoaer.exe~DFA7D.tmp

description	pid	process	target process
PID 1032 wrote to memory of 1740	1032	21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe	ogpoaer.exe
PID 1032 wrote to memory of 1740	1032	21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe	ogpoaer.exe
PID 1032 wrote to memory of 1740	1032	21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe	ogpoaer.exe
PID 1032 wrote to memory of 1740	1032	21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe	ogpoaer.exe
PID 1740 wrote to memory of 556	1740	ogpoaer.exe	~DFA7D.tmp
PID 1740 wrote to memory of 556	1740	ogpoaer.exe	~DFA7D.tmp
PID 1740 wrote to memory of 556	1740	ogpoaer.exe	~DFA7D.tmp
PID 1740 wrote to memory of 556	1740	ogpoaer.exe	~DFA7D.tmp
PID 1032 wrote to memory of 760	1032	21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe	cmd.exe
PID 1032 wrote to memory of 760	1032	21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe	cmd.exe
PID 1032 wrote to memory of 760	1032	21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe	cmd.exe
PID 1032 wrote to memory of 760	1032	21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe	cmd.exe
PID 556 wrote to memory of 552	556	~DFA7D.tmp	hukuder.exe
PID 556 wrote to memory of 552	556	~DFA7D.tmp	hukuder.exe
PID 556 wrote to memory of 552	556	~DFA7D.tmp	hukuder.exe
PID 556 wrote to memory of 552	556	~DFA7D.tmp	hukuder.exe

C:\Users\Admin\AppData\Local\Temp\21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe
"C:\Users\Admin\AppData\Local\Temp\21c506e618fe07f4b369d1401a2ac5294408b1efbb1dae44c5cbafc6ea27e7da.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\ogpoaer.exe
  C:\Users\Admin\AppData\Local\Temp\ogpoaer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\~DFA7D.tmp
    C:\Users\Admin\AppData\Local\Temp\~DFA7D.tmp OK
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\hukuder.exe
      "C:\Users\Admin\AppData\Local\Temp\hukuder.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uninsep.bat" "
  2⤵
  - Deletes itself
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uninsep.bat

Filesize
341B

MD5
d3e0c2aee919583dfdc4f2bb80afc588

SHA1
26a0d4d7e957d9689a85b0a3548af110799c69da

SHA256
ffc8c99f1241bf6455f3f7b1ade9c9f53c87341006f7785362fb097d32a253c5

SHA512
011ab3259993911e6a88432937d65ad7dfe17d45f38aba7ce38943cf1b62c5fb7c9f68053102602d60b1733945972674f950521e0560b175d64bd3889a52b0f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\gbp.ini

Filesize
104B

MD5
86bb2dbeaef655893262f3c041f6afe2

SHA1
1b26ff1241c1353bd506c18bd0c11878076ba65d

SHA256
4a57643d2c59d1235bc0926f845583f39345839e3e9428ad619eb4b6baf96ad2

SHA512
58294cfaa5882a4c5625c03fe6f9e4882912b31f7169241f95626745d66c0a746083a9044365943d66ae7a420113d28c0ddd642c4ed697c683deb63796a13d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
480B

MD5
7dc065b30566ca43dd1afaa52157c37f

SHA1
e72d8a51e1ff41d98bdc5c211676a941df82e812

SHA256
ad42140d8d6e01e8bc0e63f5647aee0c6b281e4f362155862f4c08a91983b43b

SHA512
0d8c458bedd85fd53286a88acf63dc602d71cbd00faea79f7ecdb4a57c9c228c5aa5d7efb1964035a78fad808f176f84192d2b125ab14f93989e99efefad99c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hukuder.exe

Filesize
391KB

MD5
697899a6da15078424aa9c145aa29940

SHA1
efa89377c0334401d2be6fda4ca92406859a8e2b

SHA256
3a8d229f7eaa5a57d6167491f40516f744c5f13a62f35ae845ad669c65f5828b

SHA512
acd71f477e9ab64bbcb656aee5538eb8d40125e32c14e4f32b7e69b4440a464649043306b4f7877eed12e1b2e63371b0e37343c4c0ac2e7fdb4c3cebdba911c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ogpoaer.exe

Filesize
605KB

MD5
570542a4313308a6e5c162849e3d84a1

SHA1
1ae08a88604b94add1259f120cdf0eab36b60a73

SHA256
efc156080bef2336c0de04773d2109db61658068ab605756f374df4710e75686

SHA512
ba28a8819b53c18f8790e44caa363b26febea22797b1f63ecc62283f31a432f17fedac043e8aa153df9a949b2ff3eef4ebcf8e6393676a413111e77f6df07310

Download Submit
C:\Users\Admin\AppData\Local\Temp\ogpoaer.exe

Filesize
605KB

MD5
570542a4313308a6e5c162849e3d84a1

SHA1
1ae08a88604b94add1259f120cdf0eab36b60a73

SHA256
efc156080bef2336c0de04773d2109db61658068ab605756f374df4710e75686

SHA512
ba28a8819b53c18f8790e44caa363b26febea22797b1f63ecc62283f31a432f17fedac043e8aa153df9a949b2ff3eef4ebcf8e6393676a413111e77f6df07310

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFA7D.tmp

Filesize
611KB

MD5
5e2251bce7b6bbde0ed7aa5d04a269ae

SHA1
22b8e8c2f36502191c308ff8825a873d7b7e10b6

SHA256
93053def2a595ff59ce21b7a33204bfbcfcf85d6d8ef6a080b3a40fbf691500e

SHA512
d24775827a4accdfa3d543ed244cd62dfb8d18ad88374d962eefec091cfbbbe9cb73e9ac4144a79d0984ffce262eebb034eb1749f95c74b825aa59c634fcf706

Download Submit
\Users\Admin\AppData\Local\Temp\hukuder.exe

Filesize
391KB

MD5
697899a6da15078424aa9c145aa29940

SHA1
efa89377c0334401d2be6fda4ca92406859a8e2b

SHA256
3a8d229f7eaa5a57d6167491f40516f744c5f13a62f35ae845ad669c65f5828b

SHA512
acd71f477e9ab64bbcb656aee5538eb8d40125e32c14e4f32b7e69b4440a464649043306b4f7877eed12e1b2e63371b0e37343c4c0ac2e7fdb4c3cebdba911c3

Download Submit
\Users\Admin\AppData\Local\Temp\ogpoaer.exe

Filesize
605KB

MD5
570542a4313308a6e5c162849e3d84a1

SHA1
1ae08a88604b94add1259f120cdf0eab36b60a73

SHA256
efc156080bef2336c0de04773d2109db61658068ab605756f374df4710e75686

SHA512
ba28a8819b53c18f8790e44caa363b26febea22797b1f63ecc62283f31a432f17fedac043e8aa153df9a949b2ff3eef4ebcf8e6393676a413111e77f6df07310

Download Submit
\Users\Admin\AppData\Local\Temp\~DFA7D.tmp

Filesize
611KB

MD5
5e2251bce7b6bbde0ed7aa5d04a269ae

SHA1
22b8e8c2f36502191c308ff8825a873d7b7e10b6

SHA256
93053def2a595ff59ce21b7a33204bfbcfcf85d6d8ef6a080b3a40fbf691500e

SHA512
d24775827a4accdfa3d543ed244cd62dfb8d18ad88374d962eefec091cfbbbe9cb73e9ac4144a79d0984ffce262eebb034eb1749f95c74b825aa59c634fcf706

Download Submit
memory/552-75-0x0000000000000000-mapping.dmp

Download
memory/552-79-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/556-72-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/556-73-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/556-77-0x00000000035B0000-0x00000000036EE000-memory.dmp

Filesize
1.2MB

Download
memory/556-65-0x0000000000000000-mapping.dmp

Download
memory/760-68-0x0000000000000000-mapping.dmp

Download
memory/1032-69-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1032-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1032-62-0x0000000001E30000-0x0000000001F0E000-memory.dmp

Filesize
888KB

Download
memory/1032-55-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1740-57-0x0000000000000000-mapping.dmp

Download
memory/1740-71-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1740-63-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download