5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665

Analysis

max time kernel
273s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe
Size

662KB
MD5

5b14f1666fed287f272a240154857250
SHA1

8b8b355715f7086fe0834aad0b04cdb26a5d462e
SHA256

5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665
SHA512

824a8aa97e353825b22559e71661174ddd83d0fd9df67881821e9cdb26a4325b004107cfc3ffce4a5a263dbad197b8d83ef74938ef25a7fc37e44793b31ac8e7
SSDEEP

12288:VHjcoe9PH96vB/fAuBcm9TyOE/xG3muGx44MG4Yx:VDgINfAuBcgcZG2uG24MG4Y

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

kaloerm.exe~DFA127.tmpemcemof.exe

pid process

468 kaloerm.exe
540 ~DFA127.tmp
1736 emcemof.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1768 cmd.exe
Loads dropped DLL 3 IoCs

Processes:

5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exekaloerm.exe~DFA127.tmp

pid process

1192 5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe
468 kaloerm.exe
540 ~DFA127.tmp
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
468	kaloerm.exe
540	~DFA127.tmp
1736	emcemof.exe

pid	process
1768	cmd.exe

pid	process
1192	5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe
468	kaloerm.exe
540	~DFA127.tmp

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

emcemof.exe

pid	process
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe
1736	emcemof.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

~DFA127.tmp

description pid process

Token: SeDebugPrivilege 540 ~DFA127.tmp

description	pid	process
Token: SeDebugPrivilege	540	~DFA127.tmp

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exekaloerm.exe~DFA127.tmp

description	pid	process	target process
PID 1192 wrote to memory of 468	1192	5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe	kaloerm.exe
PID 1192 wrote to memory of 468	1192	5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe	kaloerm.exe
PID 1192 wrote to memory of 468	1192	5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe	kaloerm.exe
PID 1192 wrote to memory of 468	1192	5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe	kaloerm.exe
PID 1192 wrote to memory of 1768	1192	5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe	cmd.exe
PID 1192 wrote to memory of 1768	1192	5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe	cmd.exe
PID 1192 wrote to memory of 1768	1192	5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe	cmd.exe
PID 1192 wrote to memory of 1768	1192	5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe	cmd.exe
PID 468 wrote to memory of 540	468	kaloerm.exe	~DFA127.tmp
PID 468 wrote to memory of 540	468	kaloerm.exe	~DFA127.tmp
PID 468 wrote to memory of 540	468	kaloerm.exe	~DFA127.tmp
PID 468 wrote to memory of 540	468	kaloerm.exe	~DFA127.tmp
PID 540 wrote to memory of 1736	540	~DFA127.tmp	emcemof.exe
PID 540 wrote to memory of 1736	540	~DFA127.tmp	emcemof.exe
PID 540 wrote to memory of 1736	540	~DFA127.tmp	emcemof.exe
PID 540 wrote to memory of 1736	540	~DFA127.tmp	emcemof.exe

C:\Users\Admin\AppData\Local\Temp\5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe
"C:\Users\Admin\AppData\Local\Temp\5995973562a9596e610b5f6c846a6739346226f03d74d35b15c795e6513ef665.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\kaloerm.exe
C:\Users\Admin\AppData\Local\Temp\kaloerm.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:468

C:\Users\Admin\AppData\Local\Temp\~DFA127.tmp
C:\Users\Admin\AppData\Local\Temp\~DFA127.tmp OK
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540

C:\Users\Admin\AppData\Local\Temp\emcemof.exe
"C:\Users\Admin\AppData\Local\Temp\emcemof.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\_uninsep.bat" "
2⤵
- Deletes itself
PID:1768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_uninsep.bat
Filesize
341B

MD5
86abecc7751c43eb2e9d6e772ffcd106

SHA1
529c4f496fe6e2db5b8fa03ef0f655ee944da044

SHA256
ba3977b2095f2b0118dd0cdb3468444415b0486f6bc9ae0bcf378c184dda9956

SHA512
cab22572b231743a5fb275107eb3f8d19b627d3706ebc5773e878ceb2c2162d9e5a42fb3344d0b5928258a099334a0164a81e232879922cfcb985bb8e286d25f

Download Submit
C:\Users\Admin\AppData\Local\Temp\emcemof.exe
Filesize
412KB

MD5
73bcdc68e7e16ec188a2d172914b6d90

SHA1
fdeb61c7c70106c47e7ab9660a79812310b99440

SHA256
b499b43cc75e0ceaa163ef55224fb63f1a9733eb1761b21d59d71b3126470246

SHA512
eaac2766f08b682004bf2091f676b097d5debf0fcf47228d8c54024fd44c2756ef1bd1d20e6f90ff596febe2da3e0e27523692f5ebbe79d2cb0293f0744329fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\gbp.ini
Filesize
104B

MD5
86bb2dbeaef655893262f3c041f6afe2

SHA1
1b26ff1241c1353bd506c18bd0c11878076ba65d

SHA256
4a57643d2c59d1235bc0926f845583f39345839e3e9428ad619eb4b6baf96ad2

SHA512
58294cfaa5882a4c5625c03fe6f9e4882912b31f7169241f95626745d66c0a746083a9044365943d66ae7a420113d28c0ddd642c4ed697c683deb63796a13d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini
Filesize
480B

MD5
082a022a4a20306e4fbd1d6b628bd992

SHA1
189bae52738097729bb336229c285167f851041f

SHA256
e1b76374c552d602f405633f81cd738b409e26c69666b5048f523321b1e48903

SHA512
ebf194586f96bf80bf79fa8fa5f2847a990ec12be32366eb681bb1e817a4fb720fa76f56e3b5dec1219fd5cfc5b2f11e021410127cfb68662fd7afbe6befd5ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\kaloerm.exe
Filesize
663KB

MD5
a79fe18c087a8534c2cfcb79cb5af095

SHA1
e73eb3175b5024008b54853f8ad1edb1d460cd52

SHA256
2c64bf7131fceb9fd1d71f4aba9737ed4d4131c53661d78c3b87737d9120cfa7

SHA512
472b8ad9fc6d4f4d5f3d7b36c280888fd69997f80dd2251c566f0fa9ba5485e25f9b635baa894e9011e85d64d1d69d605be2450c386dd3641305b0ceb2ae0f8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\kaloerm.exe
Filesize
663KB

MD5
a79fe18c087a8534c2cfcb79cb5af095

SHA1
e73eb3175b5024008b54853f8ad1edb1d460cd52

SHA256
2c64bf7131fceb9fd1d71f4aba9737ed4d4131c53661d78c3b87737d9120cfa7

SHA512
472b8ad9fc6d4f4d5f3d7b36c280888fd69997f80dd2251c566f0fa9ba5485e25f9b635baa894e9011e85d64d1d69d605be2450c386dd3641305b0ceb2ae0f8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFA127.tmp
Filesize
668KB

MD5
71921d7148c12a7c43719c09f5dbd51b

SHA1
cd87933bfe4590c886891e167093df717a1552e5

SHA256
2daf5b4df6e1378d7c1cb987121d8405a8721a49834075ab988976f751f154ee

SHA512
0188f57ea56e9720844ef783bbe2d0d941823ca504171b8dfdafde2b0d809a217f1f5e82ede9739dc9b786a4fa96f0c5e9f4bee6bfbc7b692bdcc8b09e738c51

Download Submit
\Users\Admin\AppData\Local\Temp\emcemof.exe
Filesize
412KB

MD5
73bcdc68e7e16ec188a2d172914b6d90

SHA1
fdeb61c7c70106c47e7ab9660a79812310b99440

SHA256
b499b43cc75e0ceaa163ef55224fb63f1a9733eb1761b21d59d71b3126470246

SHA512
eaac2766f08b682004bf2091f676b097d5debf0fcf47228d8c54024fd44c2756ef1bd1d20e6f90ff596febe2da3e0e27523692f5ebbe79d2cb0293f0744329fa

Download Submit
\Users\Admin\AppData\Local\Temp\kaloerm.exe
Filesize
663KB

MD5
a79fe18c087a8534c2cfcb79cb5af095

SHA1
e73eb3175b5024008b54853f8ad1edb1d460cd52

SHA256
2c64bf7131fceb9fd1d71f4aba9737ed4d4131c53661d78c3b87737d9120cfa7

SHA512
472b8ad9fc6d4f4d5f3d7b36c280888fd69997f80dd2251c566f0fa9ba5485e25f9b635baa894e9011e85d64d1d69d605be2450c386dd3641305b0ceb2ae0f8d

Download Submit
\Users\Admin\AppData\Local\Temp\~DFA127.tmp
Filesize
668KB

MD5
71921d7148c12a7c43719c09f5dbd51b

SHA1
cd87933bfe4590c886891e167093df717a1552e5

SHA256
2daf5b4df6e1378d7c1cb987121d8405a8721a49834075ab988976f751f154ee

SHA512
0188f57ea56e9720844ef783bbe2d0d941823ca504171b8dfdafde2b0d809a217f1f5e82ede9739dc9b786a4fa96f0c5e9f4bee6bfbc7b692bdcc8b09e738c51

Download Submit
memory/468-60-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/468-72-0x0000000002D00000-0x0000000002DDE000-memory.dmp

Filesize
888KB

Download
memory/468-58-0x0000000000000000-mapping.dmp

Download
memory/468-74-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/540-73-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/540-66-0x0000000000000000-mapping.dmp

Download
memory/540-75-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/540-79-0x0000000003720000-0x000000000385E000-memory.dmp

Filesize
1.2MB

Download
memory/1192-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1192-69-0x0000000001E40000-0x0000000001F1E000-memory.dmp

Filesize
888KB

Download
memory/1192-67-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1192-57-0x0000000001E40000-0x0000000001F1E000-memory.dmp

Filesize
888KB

Download
memory/1192-55-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1736-77-0x0000000000000000-mapping.dmp

Download
memory/1736-80-0x0000000000400000-0x000000000053E000-memory.dmp

Filesize
1.2MB

Download
memory/1768-64-0x0000000000000000-mapping.dmp

Download