5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07

Analysis

max time kernel
177s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe
Size 2.9MB
Sample221124-pa16bsff7w
SHA256 5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07
MD5 e0b200b3a55378e12fd8a4c8a5892552
SHA1 98284db4c06bebe7ec288442d57a6c275f0a241c
SHA512 6b01407b124e24ec7d6774a31f4c7ae7ca6a94c98aa0082044a4e55055479da591eb1bc9dd1c74f6c651a944c27c91f95b9965520c44af44b9c8d8f8f5959692
SSDEEP 49152:A9BfDauF3rt3g7GNBamkmmCwLtLV3viyKXtLGNWImcuwLbo+7:AfTxzG7CwdV3vidSWHLLA
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4908	xvs64.exe
3648	bot.exe
3760	dfa32.exe
1544	irsetup.exe
5020	dfa32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e19-143.dat	upx
behavioral2/files/0x0006000000022e19-145.dat	upx
behavioral2/memory/1544-146-0x0000000000400000-0x00000000007CB000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	xvs64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	bot.exe

Loads dropped DLL 1 IoCs

pid	Process
1544	irsetup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	dfa32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfa32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dfa32.exe"	dfa32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3760 set thread context of 5020	3760	dfa32.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3648	bot.exe
3760	dfa32.exe
1544	irsetup.exe
1544	irsetup.exe
1544	irsetup.exe
1544	irsetup.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 4908	2980	5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe	84
PID 2980 wrote to memory of 4908	2980	5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe	84
PID 2980 wrote to memory of 4908	2980	5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe	84
PID 2980 wrote to memory of 3648	2980	5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe	86
PID 2980 wrote to memory of 3648	2980	5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe	86
PID 2980 wrote to memory of 3648	2980	5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe	86
PID 4908 wrote to memory of 3760	4908	xvs64.exe	87
PID 4908 wrote to memory of 3760	4908	xvs64.exe	87
PID 4908 wrote to memory of 3760	4908	xvs64.exe	87
PID 3648 wrote to memory of 1544	3648	bot.exe	88
PID 3648 wrote to memory of 1544	3648	bot.exe	88
PID 3648 wrote to memory of 1544	3648	bot.exe	88
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89
PID 3760 wrote to memory of 5020	3760	dfa32.exe	89

C:\Users\Admin\AppData\Local\Temp\5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe
"C:\Users\Admin\AppData\Local\Temp\5c0da0aa31dc0c67040a78139b78a21095ff89e0c2aac224a1436c07c83bbb07.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\xvs64.exe
  "C:\Users\Admin\AppData\Local\Temp\xvs64.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Users\Admin\AppData\Local\Temp\dfa32.exe
    "C:\Users\Admin\AppData\Local\Temp\dfa32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\dfa32.exe
      "C:\Users\Admin\AppData\Local\Temp\dfa32.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:5020
- C:\Users\Admin\AppData\Local\Temp\bot.exe
  "C:\Users\Admin\AppData\Local\Temp\bot.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1749498 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\bot.exe" "__IRCT:3" "__IRTSS:2621767" "__IRSID:S-1-5-21-2386679933-1492765628-3466841596-1000"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.3MB
SHA256 9a7bb59efdca3a44db5227ed2a501681e976ec53dce37934990c36b58d51e783
MD5 1437d30476f86879af27aa3c4f5cf2ef
SHA1 cea48b9a0103cb60738fe23c2927c02880d7d954
SHA512 41c17395e32949f11214295a4237a3e1f80b29a6299f79f7764b5990bff73434d3c60084461d872361fb275dca943a8a7fb770fd9d8d542b2cd3091e4d533ac6
SSDEEP 24576:UFYGY9+9d/G7P9lkQ/exnzGn4dLsUvqkaT+0BpCCh+PDedW:LN26FOnzGn6LJvqkwnpC+mZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.3MB
SHA256 9a7bb59efdca3a44db5227ed2a501681e976ec53dce37934990c36b58d51e783
MD5 1437d30476f86879af27aa3c4f5cf2ef
SHA1 cea48b9a0103cb60738fe23c2927c02880d7d954
SHA512 41c17395e32949f11214295a4237a3e1f80b29a6299f79f7764b5990bff73434d3c60084461d872361fb275dca943a8a7fb770fd9d8d542b2cd3091e4d533ac6
SSDEEP 24576:UFYGY9+9d/G7P9lkQ/exnzGn4dLsUvqkaT+0BpCCh+PDedW:LN26FOnzGn6LJvqkwnpC+mZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Size 318KB
SHA256 12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650
MD5 b5fc476c1bf08d5161346cc7dd4cb0ba
SHA1 280fac9cf711d93c95f6b80ac97d89cf5853c096
SHA512 17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697
SSDEEP 6144:ukn2LG5bwf92+0HiDhAqUS0aMkvAvBtAOj+JzOghK:r2x2cdUhZuIBt8xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Size 318KB
SHA256 12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650
MD5 b5fc476c1bf08d5161346cc7dd4cb0ba
SHA1 280fac9cf711d93c95f6b80ac97d89cf5853c096
SHA512 17fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697
SSDEEP 6144:ukn2LG5bwf92+0HiDhAqUS0aMkvAvBtAOj+JzOghK:r2x2cdUhZuIBt8xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

bot.exe

Path C:\Users\Admin\AppData\Local\Temp\bot.exe
Size 2.5MB
SHA256 65bf4a5ab8bd9e351c01a2a45eec3062e39717e6dc4694ed7c1f7b54f3d38f75
MD5 2464b4bf0871616c933bfe12f5b2ab71
SHA1 561f70e457cb22fcbe344e4605be3ee9f2ddd606
SHA512 3cdbd672c92c0808e11197577564a53db1560065b45aa57aabe2a4df0c2c2aa93357762359d575a0bafb2750239dda26689d82135656e12ae749e85ccc1e400b
SSDEEP 49152:1N26FOnzGn6LJvqkwnpC+mFd6uIccqFAbvFfA0ngPMelled:106FOznLo0+Ud6uxcqFAL/10Yd
MD5 SHA1 SHA512 SSDEEP

Submit Download

bot.exe

Path C:\Users\Admin\AppData\Local\Temp\bot.exe
Size 2.5MB
SHA256 65bf4a5ab8bd9e351c01a2a45eec3062e39717e6dc4694ed7c1f7b54f3d38f75
MD5 2464b4bf0871616c933bfe12f5b2ab71
SHA1 561f70e457cb22fcbe344e4605be3ee9f2ddd606
SHA512 3cdbd672c92c0808e11197577564a53db1560065b45aa57aabe2a4df0c2c2aa93357762359d575a0bafb2750239dda26689d82135656e12ae749e85ccc1e400b
SSDEEP 49152:1N26FOnzGn6LJvqkwnpC+mFd6uIccqFAbvFfA0ngPMelled:106FOznLo0+Ud6uxcqFAL/10Yd
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfa32.exe

Path C:\Users\Admin\AppData\Local\Temp\dfa32.exe
Size 608KB
SHA256 99f99873260a11412f20a1807d555a002885da4e6621fdc2414868ee9037c8a6
MD5 1790dec7069c9143438ed98609f92153
SHA1 af7901823025e64bc6e558e450e587ea6e0c9b8f
SHA512 45322498696b45e0f2ca58322b8395a5a92727283fa1dfbbc5a97e84e5f0a879107dd129ce8bd465f402ae198f52492365aa867e10ebefb7e48dece140d5a9bd
SSDEEP 12288:M3n6PUhNKPLm/SUeOyZSgH2UKjPMLKLEXsTmR6CcaYlx:MX689SxOIvK0WoXNR9Yl
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfa32.exe

Path C:\Users\Admin\AppData\Local\Temp\dfa32.exe
Size 608KB
SHA256 99f99873260a11412f20a1807d555a002885da4e6621fdc2414868ee9037c8a6
MD5 1790dec7069c9143438ed98609f92153
SHA1 af7901823025e64bc6e558e450e587ea6e0c9b8f
SHA512 45322498696b45e0f2ca58322b8395a5a92727283fa1dfbbc5a97e84e5f0a879107dd129ce8bd465f402ae198f52492365aa867e10ebefb7e48dece140d5a9bd
SSDEEP 12288:M3n6PUhNKPLm/SUeOyZSgH2UKjPMLKLEXsTmR6CcaYlx:MX689SxOIvK0WoXNR9Yl
MD5 SHA1 SHA512 SSDEEP

Submit Download

dfa32.exe

Path C:\Users\Admin\AppData\Local\Temp\dfa32.exe
Size 608KB
SHA256 99f99873260a11412f20a1807d555a002885da4e6621fdc2414868ee9037c8a6
MD5 1790dec7069c9143438ed98609f92153
SHA1 af7901823025e64bc6e558e450e587ea6e0c9b8f
SHA512 45322498696b45e0f2ca58322b8395a5a92727283fa1dfbbc5a97e84e5f0a879107dd129ce8bd465f402ae198f52492365aa867e10ebefb7e48dece140d5a9bd
SSDEEP 12288:M3n6PUhNKPLm/SUeOyZSgH2UKjPMLKLEXsTmR6CcaYlx:MX689SxOIvK0WoXNR9Yl
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbi61.dll

Path C:\Users\Admin\AppData\Local\Temp\tbi61.dll
Size 24B
SHA256 eaa98842aff6893c657906519683b6a63da8232f0013979191b39f56ad1b9f9f
MD5 fc51503ffc90028454c44d27c3dde298
SHA1 460cea109c01f12bcc0ef1fb9a2fa5bd7d0b327b
SHA512 db07df5a182401c725e4ed275afbd2d0568d8e933cae1b1be5b63338a7843788eff0ce97881b4f363b1b25e107474821a477e0b2f0f9a951b3a1c65b51dd827e
MD5 SHA1 SHA512

Submit Download

xvs64.exe

Path C:\Users\Admin\AppData\Local\Temp\xvs64.exe
Size 555KB
SHA256 d04de16b873f59aed65983e58a7c36004278a4dde9bd0292d99aa4f4aaed404f
MD5 ec158de96c194ae61d0b409e6b1c396e
SHA1 e74dae683686475f7ab3bbe9467250e9260a3af0
SHA512 44d4b3e795b650a1ac2258604a28e924f42fc8e99bdaa973da76bdef79a03bae7d244c78db7d0d3652d31c3c9698b6314e17b818b0f38343288d62883a0fbc94
SSDEEP 12288:4utrzh9xOXkXLSijumAz4/9W/9ui8QCmtLkAp+TWfQtT5su0pbJwNJGB4cH/3wq:4utr5OUXqmAzU8omdzfQtTflNTIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

xvs64.exe

Path C:\Users\Admin\AppData\Local\Temp\xvs64.exe
Size 555KB
SHA256 d04de16b873f59aed65983e58a7c36004278a4dde9bd0292d99aa4f4aaed404f
MD5 ec158de96c194ae61d0b409e6b1c396e
SHA1 e74dae683686475f7ab3bbe9467250e9260a3af0
SHA512 44d4b3e795b650a1ac2258604a28e924f42fc8e99bdaa973da76bdef79a03bae7d244c78db7d0d3652d31c3c9698b6314e17b818b0f38343288d62883a0fbc94
SSDEEP 12288:4utrzh9xOXkXLSijumAz4/9W/9ui8QCmtLkAp+TWfQtT5su0pbJwNJGB4cH/3wq:4utr5OUXqmAzU8omdzfQtTflNTIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1544-146-0x0000000000400000-0x00000000007CB000-memory.dmp

Download

memory/5020-151-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/5020-149-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/5020-153-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/5020-154-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/5020-156-0x0000000000400000-0x0000000000483000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads