a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8

Analysis

max time kernel
24s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
Size

84KB
MD5

3614775c4d2b7504d608360d5b4db290
SHA1

5d7dcc6f6c318ae23ae9cd19665907fa8ae8c696
SHA256

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8
SHA512

b3b6d1706f7675000b53a169effa5828e43514f939a3a2957e6e93ec29fd04aaee865636bb3988fe06a641be113c46ef1296b21bc3b213d84b767919a09e4391
SSDEEP

768:DTbYNscGYzZ2i+BJd/bI0/F/NstMlwQTOxelNmw5jRnDU5b:DTWG6H+n5IUJxdlNmKjRqb

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

doarook.exe

pid process

4608 doarook.exe

pid	process
4608	doarook.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exedoarook.exe

pid process

2444 a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
4608 doarook.exe

pid	process
2444	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
4608	doarook.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe

description	pid	process	target process
PID 2444 wrote to memory of 4608	2444	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe	doarook.exe
PID 2444 wrote to memory of 4608	2444	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe	doarook.exe
PID 2444 wrote to memory of 4608	2444	a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe	doarook.exe

C:\Users\Admin\AppData\Local\Temp\a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe
"C:\Users\Admin\AppData\Local\Temp\a87883b9b919198edf85a1584a20f261b119ce34e6af34ac854e963d49e1d2d8.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444

C:\Users\Admin\doarook.exe
"C:\Users\Admin\doarook.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\doarook.exe

Filesize
84KB

MD5
b9d920f5fabd49f199378301cf46077d

SHA1
66e3276697aaf4f34eade3884a256f4803a6c4e7

SHA256
8d9b6f9abcbae967c5ba24ece9746b15371d1fa722f888e9256ac0a8bcd2a395

SHA512
846016f8cd2f96ce5afb84b082f50f8a27ca54d71d200d316dc5628bf948e55166ac8abe6a37c889db713219653420818933262be3741e30f778da193c9a993e

Download Submit
C:\Users\Admin\doarook.exe

Filesize
84KB

MD5
b9d920f5fabd49f199378301cf46077d

SHA1
66e3276697aaf4f34eade3884a256f4803a6c4e7

SHA256
8d9b6f9abcbae967c5ba24ece9746b15371d1fa722f888e9256ac0a8bcd2a395

SHA512
846016f8cd2f96ce5afb84b082f50f8a27ca54d71d200d316dc5628bf948e55166ac8abe6a37c889db713219653420818933262be3741e30f778da193c9a993e

Download Submit
memory/4608-134-0x0000000000000000-mapping.dmp

Download