Analysis
-
max time kernel
37s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 00:01
Static task
static1
Behavioral task
behavioral1
Sample
0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
Resource
win10v2004-20221111-en
General
-
Target
0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
-
Size
400KB
-
MD5
349fad42277afb30c8324b3b83c57d35
-
SHA1
bd99021a4e77d1ea517f91981c9b34cef217bea2
-
SHA256
0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d
-
SHA512
d8b07c6af456c55049d1fdf916a8a2ba77ca4e138ffb258f6a7419fb4ece6ac9ba843bc9b35e4d45875b1d15d4fa74a22f1abfd86bdcb7ad2a1d2448505f1391
-
SSDEEP
6144:HMkXEBJ4f03VZSaH8WwQVcD4fsomxbHQlGUi2jhsmHplLxPRJfsoy/Oti+azNC:AVoIJwQVcD4fnGUJsmHplLxJJf5uzY
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2012 main5.exe 1732 netlos.exe -
Loads dropped DLL 2 IoCs
pid Process 2012 main5.exe 2012 main5.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 main5.exe File opened for modification \??\PhysicalDrive0 netlos.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\svchoct.exe 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe File opened for modification C:\Windows\SysWOW64\rmot2.exe 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe File opened for modification C:\Windows\SysWOW64\rmot.exe 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe File opened for modification C:\Windows\SysWOW64\netloss.exe main5.exe File created C:\Windows\SysWOW64\dllcache\SOUNDMAN.exe main5.exe File created C:\Windows\SysWOW64\log.sql 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe File opened for modification C:\Windows\SysWOW64\svchoct2.exe 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe File created C:\Windows\SysWOW64\netloss.exe main5.exe File opened for modification C:\Windows\SysWOW64\dllcache\SOUNDMAN.exe main5.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\main52.tmp 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe File opened for modification C:\Windows\main5.tmp 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
pid Process 1736 taskkill.exe 1088 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1088 taskkill.exe Token: SeDebugPrivilege 1736 taskkill.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1364 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe 2012 main5.exe 1732 netlos.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2012 1364 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe 27 PID 1364 wrote to memory of 2012 1364 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe 27 PID 1364 wrote to memory of 2012 1364 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe 27 PID 1364 wrote to memory of 2012 1364 0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe 27 PID 2012 wrote to memory of 1732 2012 main5.exe 28 PID 2012 wrote to memory of 1732 2012 main5.exe 28 PID 2012 wrote to memory of 1732 2012 main5.exe 28 PID 2012 wrote to memory of 1732 2012 main5.exe 28 PID 1732 wrote to memory of 1736 1732 netlos.exe 29 PID 1732 wrote to memory of 1736 1732 netlos.exe 29 PID 1732 wrote to memory of 1736 1732 netlos.exe 29 PID 1732 wrote to memory of 1736 1732 netlos.exe 29 PID 1732 wrote to memory of 1088 1732 netlos.exe 30 PID 1732 wrote to memory of 1088 1732 netlos.exe 30 PID 1732 wrote to memory of 1088 1732 netlos.exe 30 PID 1732 wrote to memory of 1088 1732 netlos.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe"C:\Users\Admin\AppData\Local\Temp\0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\main5.exe"C:\Windows\main5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\netlos.exe"C:\Windows\system32\netlos.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im netlos.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im svchoct.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20B
MD57c22628b08f0af2e7449794ff4958136
SHA1adbaef0b6981ead722870796e1b1e59531878790
SHA256324b3ff2551cf509ab487164603d9e9776ba1520394dc973d85c619fa9b8141d
SHA512b5a41a1ca0853a98afc8459f671547cd40b9116afa04add0eb7c9134c8d36a71ad4ebed87dab631eb63ee5f5b0a9957410a67f6a947823a6843d665fbb0c1424
-
Filesize
304KB
MD5756c1a61ddc096120a220f9ace927d5c
SHA1fbba17a4f806839a5a3f71fdef70d05f24cf66d6
SHA2568cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9
SHA5124994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0
-
Filesize
304KB
MD5756c1a61ddc096120a220f9ace927d5c
SHA1fbba17a4f806839a5a3f71fdef70d05f24cf66d6
SHA2568cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9
SHA5124994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0
-
Filesize
304KB
MD5756c1a61ddc096120a220f9ace927d5c
SHA1fbba17a4f806839a5a3f71fdef70d05f24cf66d6
SHA2568cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9
SHA5124994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0
-
Filesize
304KB
MD5756c1a61ddc096120a220f9ace927d5c
SHA1fbba17a4f806839a5a3f71fdef70d05f24cf66d6
SHA2568cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9
SHA5124994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0
-
Filesize
304KB
MD5756c1a61ddc096120a220f9ace927d5c
SHA1fbba17a4f806839a5a3f71fdef70d05f24cf66d6
SHA2568cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9
SHA5124994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0
-
Filesize
304KB
MD5756c1a61ddc096120a220f9ace927d5c
SHA1fbba17a4f806839a5a3f71fdef70d05f24cf66d6
SHA2568cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9
SHA5124994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0