a9f02907443c868af7bd8a79299041994a4207c22fc74d338d7064b530ab9c18

General

Target

ecard.exe
Size

540KB
MD5

7e1fe97ad2bbe4694db516da79c34791
SHA1

faeb9e85135b7bc13d994f00f94b9285e962b39a
SHA256

9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d
SHA512

3c1267dab94c1159d7339c65ecdb63c1792079fbe65527ed934b7ed11d39233bd8cd711aa1d93a30c118fbf15dba18f60cca54cfdc08ed95045b55d70debeeaf
SSDEEP

6144:lhLpD3Ave4QRZQBdU9rGhYCMxpLoZhVj3aUd5nrbHK7x+rZbMkN2PaWIZqbixxn5:lTcvhzU9ihYXxpUHVjfrjBrZok/V

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Cloud.exe

pid process

4784 Cloud.exe

pid	process
4784	Cloud.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1072-136-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/1072-138-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/1072-139-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/1072-149-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

ecard.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ecard.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ecard.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ecard.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cloud = "C:\\Users\\Admin\\AppData\\Roaming\\Cloud\\Cloud.exe"	ecard.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ecard.exe

description pid process target process

PID 2448 set thread context of 1072 2448 ecard.exe ecard.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ecard.exeecard.exeCloud.exe

pid process

2448 ecard.exe
1072 ecard.exe
4784 Cloud.exe

description	pid	process	target process
PID 2448 set thread context of 1072	2448	ecard.exe	ecard.exe

pid	process
2448	ecard.exe
1072	ecard.exe
4784	Cloud.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ecard.exeCloud.exe

description	pid	process	target process
PID 2448 wrote to memory of 1072	2448	ecard.exe	ecard.exe
PID 2448 wrote to memory of 1072	2448	ecard.exe	ecard.exe
PID 2448 wrote to memory of 1072	2448	ecard.exe	ecard.exe
PID 2448 wrote to memory of 1072	2448	ecard.exe	ecard.exe
PID 2448 wrote to memory of 1072	2448	ecard.exe	ecard.exe
PID 2448 wrote to memory of 1072	2448	ecard.exe	ecard.exe
PID 2448 wrote to memory of 1072	2448	ecard.exe	ecard.exe
PID 2448 wrote to memory of 1072	2448	ecard.exe	ecard.exe
PID 2448 wrote to memory of 4784	2448	ecard.exe	Cloud.exe
PID 2448 wrote to memory of 4784	2448	ecard.exe	Cloud.exe
PID 2448 wrote to memory of 4784	2448	ecard.exe	Cloud.exe
PID 4784 wrote to memory of 3656	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3656	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3656	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3656	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3656	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3656	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3656	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4236	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4236	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4236	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4236	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4236	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4236	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4236	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4040	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4040	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4040	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4040	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4040	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4040	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4040	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3968	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3968	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3968	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3968	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3968	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3968	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3968	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 2136	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 2136	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 2136	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 2136	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 2136	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 2136	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 2136	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3100	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3100	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3100	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3100	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3100	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3100	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 3100	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 1564	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 1564	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 1564	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 1564	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 1564	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 1564	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 1564	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4404	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4404	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4404	4784	Cloud.exe	iexplore.exe
PID 4784 wrote to memory of 4404	4784	Cloud.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\ecard.exe
"C:\Users\Admin\AppData\Local\Temp\ecard.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448

C:\Users\Admin\AppData\Local\Temp\ecard.exe
"C:\Users\Admin\AppData\Local\Temp\ecard.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1072

C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3656

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4236

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4040

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3968

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2136

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3100

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1564

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4404

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3560

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4724

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:5092

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1700

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3628

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3248

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3232

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:5048

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3572

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4940

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4840

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4552

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2832

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2076

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2192

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2112

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4312

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2544

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4064

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3236

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3468

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3876

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1312

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2900

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4520

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4320

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3472

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3772

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1404

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4716

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4196

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3308

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:492

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4392

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:3980

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2496

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2556

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:5104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1356

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2508

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4868

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:5016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4164

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4220

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1124

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:4340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
Filesize
540KB

MD5
0b8a87bd741cd5e7a92294ff3aff1e0d

SHA1
717100cdd331da09032f3c9184d9df5c1b5805a1

SHA256
e4a9c66209dcb118c985c8b0b78d9eb030145c9cd84e73dca47f4986d6ae7c52

SHA512
8fd9f5afdabb21689f44fe3d9dac4b6280fe5dbecc01c94302ac384b02c2be707607479518dc6d8067ead9b06fbd623bf0b4751f0d3a4d260b83aaff1185b258

Download Submit
C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
Filesize
540KB

MD5
0b8a87bd741cd5e7a92294ff3aff1e0d

SHA1
717100cdd331da09032f3c9184d9df5c1b5805a1

SHA256
e4a9c66209dcb118c985c8b0b78d9eb030145c9cd84e73dca47f4986d6ae7c52

SHA512
8fd9f5afdabb21689f44fe3d9dac4b6280fe5dbecc01c94302ac384b02c2be707607479518dc6d8067ead9b06fbd623bf0b4751f0d3a4d260b83aaff1185b258

Download Submit
memory/1072-138-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1072-139-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1072-136-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1072-135-0x0000000000000000-mapping.dmp

Download
memory/1072-149-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2448-134-0x0000000000823000-0x0000000000825000-memory.dmp

Filesize
8KB

Download
memory/2448-140-0x0000000000823000-0x0000000000825000-memory.dmp

Filesize
8KB

Download
memory/2448-143-0x0000000000823000-0x0000000000825000-memory.dmp

Filesize
8KB

Download
memory/4784-144-0x0000000000000000-mapping.dmp

Download
memory/4784-150-0x00000000006B3000-0x00000000006B5000-memory.dmp

Filesize
8KB

Download
memory/4784-151-0x00000000006B3000-0x00000000006B5000-memory.dmp

Filesize
8KB

Download
memory/4784-152-0x00000000006B3000-0x00000000006B5000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads