a9f02907443c868af7bd8a79299041994a4207c22fc74d338d7064b530ab9c18

General

Target

ecard.exe
Size

540KB
MD5

7e1fe97ad2bbe4694db516da79c34791
SHA1

faeb9e85135b7bc13d994f00f94b9285e962b39a
SHA256

9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d
SHA512

3c1267dab94c1159d7339c65ecdb63c1792079fbe65527ed934b7ed11d39233bd8cd711aa1d93a30c118fbf15dba18f60cca54cfdc08ed95045b55d70debeeaf
SSDEEP

6144:lhLpD3Ave4QRZQBdU9rGhYCMxpLoZhVj3aUd5nrbHK7x+rZbMkN2PaWIZqbixxn5:lTcvhzU9ihYXxpUHVjfrjBrZok/V

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Cloud.exe

pid process

1764 Cloud.exe

pid	process
1764	Cloud.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2028-56-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2028-59-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2028-60-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2028-65-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

ecard.exe

pid process

1280 ecard.exe
1280 ecard.exe

pid	process
1280	ecard.exe
1280	ecard.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ecard.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cloud = "C:\\Users\\Admin\\AppData\\Roaming\\Cloud\\Cloud.exe"	ecard.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ecard.exe

description pid process target process

PID 1280 set thread context of 2028 1280 ecard.exe ecard.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

848 DllHost.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ecard.exeecard.exeCloud.exe

pid process

1280 ecard.exe
2028 ecard.exe
1764 Cloud.exe

description	pid	process	target process
PID 1280 set thread context of 2028	1280	ecard.exe	ecard.exe

pid	process
848	DllHost.exe

pid	process
1280	ecard.exe
2028	ecard.exe
1764	Cloud.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ecard.exeCloud.exe

description	pid	process	target process
PID 1280 wrote to memory of 2028	1280	ecard.exe	ecard.exe
PID 1280 wrote to memory of 2028	1280	ecard.exe	ecard.exe
PID 1280 wrote to memory of 2028	1280	ecard.exe	ecard.exe
PID 1280 wrote to memory of 2028	1280	ecard.exe	ecard.exe
PID 1280 wrote to memory of 2028	1280	ecard.exe	ecard.exe
PID 1280 wrote to memory of 2028	1280	ecard.exe	ecard.exe
PID 1280 wrote to memory of 2028	1280	ecard.exe	ecard.exe
PID 1280 wrote to memory of 2028	1280	ecard.exe	ecard.exe
PID 1280 wrote to memory of 2028	1280	ecard.exe	ecard.exe
PID 1280 wrote to memory of 1764	1280	ecard.exe	Cloud.exe
PID 1280 wrote to memory of 1764	1280	ecard.exe	Cloud.exe
PID 1280 wrote to memory of 1764	1280	ecard.exe	Cloud.exe
PID 1280 wrote to memory of 1764	1280	ecard.exe	Cloud.exe
PID 1764 wrote to memory of 920	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 920	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 920	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 920	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 920	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 920	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 920	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 920	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 920	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 912	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 912	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 912	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 912	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 912	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 912	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 912	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 912	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 912	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 880	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 880	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 880	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 880	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 880	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 880	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 880	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 880	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 880	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1676	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1676	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1676	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1676	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1676	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1676	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1676	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1676	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1676	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1208	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1208	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1208	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1208	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1208	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1208	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1208	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1208	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 1208	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 868	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 868	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 868	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 868	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 868	1764	Cloud.exe	iexplore.exe
PID 1764 wrote to memory of 868	1764	Cloud.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\ecard.exe
"C:\Users\Admin\AppData\Local\Temp\ecard.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\ecard.exe
"C:\Users\Admin\AppData\Local\Temp\ecard.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:920

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:912

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1676

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:880

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:868

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:456

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:812

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1220

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:988

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1628

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1680

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1624

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1668

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:680

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1732

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1736

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1992

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:472

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:524

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1432

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:816

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1928

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1684

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1528

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1824

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:808

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2024

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:568

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1008

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1592

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:780

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1564

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1480

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:556

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:564

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:484

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:836

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1072

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1076

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2004

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1600

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1608

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1712

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1604

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1728

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1368

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1264

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:804

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1888

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1136

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1496

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:864

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1448

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1124

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:848

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CWH49.jpg
Filesize
161KB

MD5
60370188ece426a5c6728cdd2016be9c

SHA1
c6fc16ba9e05e9f8f05b6ec33ac0b1f42bdfe88a

SHA256
06955da091df60466c7f92abd77ae8a40233147746fe82e37bd8c15b66cdfa3e

SHA512
d16b7617369631de09cb0fca486345e2884581bf0683d4390b1ab44ed17049ef54e4f31fa1cddd567ca9bc6726b5ca761ee9471a4e80a5f6ec2cd9e6cec71845

Download Submit
C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
Filesize
540KB

MD5
0b8a87bd741cd5e7a92294ff3aff1e0d

SHA1
717100cdd331da09032f3c9184d9df5c1b5805a1

SHA256
e4a9c66209dcb118c985c8b0b78d9eb030145c9cd84e73dca47f4986d6ae7c52

SHA512
8fd9f5afdabb21689f44fe3d9dac4b6280fe5dbecc01c94302ac384b02c2be707607479518dc6d8067ead9b06fbd623bf0b4751f0d3a4d260b83aaff1185b258

Download Submit
\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
Filesize
540KB

MD5
0b8a87bd741cd5e7a92294ff3aff1e0d

SHA1
717100cdd331da09032f3c9184d9df5c1b5805a1

SHA256
e4a9c66209dcb118c985c8b0b78d9eb030145c9cd84e73dca47f4986d6ae7c52

SHA512
8fd9f5afdabb21689f44fe3d9dac4b6280fe5dbecc01c94302ac384b02c2be707607479518dc6d8067ead9b06fbd623bf0b4751f0d3a4d260b83aaff1185b258

Download Submit
\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
Filesize
540KB

MD5
0b8a87bd741cd5e7a92294ff3aff1e0d

SHA1
717100cdd331da09032f3c9184d9df5c1b5805a1

SHA256
e4a9c66209dcb118c985c8b0b78d9eb030145c9cd84e73dca47f4986d6ae7c52

SHA512
8fd9f5afdabb21689f44fe3d9dac4b6280fe5dbecc01c94302ac384b02c2be707607479518dc6d8067ead9b06fbd623bf0b4751f0d3a4d260b83aaff1185b258

Download Submit
memory/1764-69-0x0000000000000000-mapping.dmp

Download
memory/2028-57-0x000000000042F670-mapping.dmp

Download
memory/2028-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2028-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2028-60-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2028-63-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2028-65-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads