0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d

General

Target

0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
Size

400KB
MD5

349fad42277afb30c8324b3b83c57d35
SHA1

bd99021a4e77d1ea517f91981c9b34cef217bea2
SHA256

0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d
SHA512

d8b07c6af456c55049d1fdf916a8a2ba77ca4e138ffb258f6a7419fb4ece6ac9ba843bc9b35e4d45875b1d15d4fa74a22f1abfd86bdcb7ad2a1d2448505f1391
SSDEEP

6144:HMkXEBJ4f03VZSaH8WwQVcD4fsomxbHQlGUi2jhsmHplLxPRJfsoy/Oti+azNC:AVoIJwQVcD4fnGUJsmHplLxJJf5uzY

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1488	main46.exe
2928	netlos.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	main46.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	netlos.exe
File opened for modification	\??\PhysicalDrive0	main46.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\log.sql	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\SysWOW64\rmot2.exe	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\SysWOW64\rmot.exe	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File created	C:\Windows\SysWOW64\netloss.exe	main46.exe
File opened for modification	C:\Windows\SysWOW64\netloss.exe	main46.exe
File created	C:\Windows\SysWOW64\dllcache\SOUNDMAN.exe	main46.exe
File opened for modification	C:\Windows\SysWOW64\svchoct2.exe	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\SysWOW64\svchoct.exe	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\SOUNDMAN.exe	main46.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\main462.tmp	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
File opened for modification	C:\Windows\main46.tmp	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
220	taskkill.exe
5100	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	taskkill.exe
Token: SeDebugPrivilege	5100	taskkill.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5000	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
1488	main46.exe
2928	netlos.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1488	5000	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe	85
PID 5000 wrote to memory of 1488	5000	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe	85
PID 5000 wrote to memory of 1488	5000	0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe	85
PID 1488 wrote to memory of 2928	1488	main46.exe	86
PID 1488 wrote to memory of 2928	1488	main46.exe	86
PID 1488 wrote to memory of 2928	1488	main46.exe	86
PID 2928 wrote to memory of 220	2928	netlos.exe	87
PID 2928 wrote to memory of 220	2928	netlos.exe	87
PID 2928 wrote to memory of 220	2928	netlos.exe	87
PID 2928 wrote to memory of 5100	2928	netlos.exe	88
PID 2928 wrote to memory of 5100	2928	netlos.exe	88
PID 2928 wrote to memory of 5100	2928	netlos.exe	88

C:\Users\Admin\AppData\Local\Temp\0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe
"C:\Users\Admin\AppData\Local\Temp\0cdead53285bef7b75782f1d46c82934f60ab372a944142efe0b3cc54d0fb39d.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\main46.exe
  "C:\Windows\main46.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\netlos.exe
    "C:\Windows\system32\netlos.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im netlos.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im svchoct.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\log.sql

Filesize
20B

MD5
7c22628b08f0af2e7449794ff4958136

SHA1
adbaef0b6981ead722870796e1b1e59531878790

SHA256
324b3ff2551cf509ab487164603d9e9776ba1520394dc973d85c619fa9b8141d

SHA512
b5a41a1ca0853a98afc8459f671547cd40b9116afa04add0eb7c9134c8d36a71ad4ebed87dab631eb63ee5f5b0a9957410a67f6a947823a6843d665fbb0c1424

Download Submit
C:\Windows\SysWOW64\netlos.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit
C:\Windows\SysWOW64\netlos.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit
C:\Windows\main46.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit
C:\Windows\main46.exe

Filesize
304KB

MD5
756c1a61ddc096120a220f9ace927d5c

SHA1
fbba17a4f806839a5a3f71fdef70d05f24cf66d6

SHA256
8cdbf771c50e1e38c0a225576395804b383cff852a8fd2d0945f047ed82cbbf9

SHA512
4994b903f25cb4be752b4cd57457334b098e79c82a4c28cd2d19d4135ee52535f059d95ebdf290d30d699a677a32ec861e67943006f2398364453c66cec735f0

Download Submit

Analysis

Sharing