Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:52
Static task
static1
Behavioral task
behavioral1
Sample
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe
Resource
win10v2004-20220812-en
General
-
Target
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe
-
Size
164KB
-
MD5
0f5429b431338533ba71edfe7a0538d9
-
SHA1
4d5e2795f8ea068c3eb543b56eda592ecddb671c
-
SHA256
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd
-
SHA512
a96e1e28b8de2f4a9f58dd5009ff4775664c38791dbb7f95a60b887527256aae27edd53a50f487a1b8e4d7982b8a09442fd1f47b94abaa850dbd2cc088c9bbff
-
SSDEEP
3072:ulRGkuKeuPeruBYAG5IqMryVOPz1Gz2YA+d1WfLIj9iKs75J9CLWDQbzKQ:ulRGkunseruBYAG5IqyeOPzYKN2WfEjH
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
LocalkqimnWCqKx.exeTrojan.exepid process 1344 LocalkqimnWCqKx.exe 1788 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Trojan.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8515eb34d8f9de5af815466e9715b3e5.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8515eb34d8f9de5af815466e9715b3e5.exe Trojan.exe -
Loads dropped DLL 1 IoCs
Processes:
LocalkqimnWCqKx.exepid process 1344 LocalkqimnWCqKx.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\8515eb34d8f9de5af815466e9715b3e5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8515eb34d8f9de5af815466e9715b3e5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Trojan.exepid process 1788 Trojan.exe 1788 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 1788 Trojan.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exeLocalkqimnWCqKx.exeTrojan.exedescription pid process target process PID 2036 wrote to memory of 1344 2036 57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe LocalkqimnWCqKx.exe PID 2036 wrote to memory of 1344 2036 57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe LocalkqimnWCqKx.exe PID 2036 wrote to memory of 1344 2036 57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe LocalkqimnWCqKx.exe PID 2036 wrote to memory of 1344 2036 57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe LocalkqimnWCqKx.exe PID 1344 wrote to memory of 1788 1344 LocalkqimnWCqKx.exe Trojan.exe PID 1344 wrote to memory of 1788 1344 LocalkqimnWCqKx.exe Trojan.exe PID 1344 wrote to memory of 1788 1344 LocalkqimnWCqKx.exe Trojan.exe PID 1344 wrote to memory of 1788 1344 LocalkqimnWCqKx.exe Trojan.exe PID 1788 wrote to memory of 916 1788 Trojan.exe netsh.exe PID 1788 wrote to memory of 916 1788 Trojan.exe netsh.exe PID 1788 wrote to memory of 916 1788 Trojan.exe netsh.exe PID 1788 wrote to memory of 916 1788 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe"C:\Users\Admin\AppData\Local\Temp\57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\LocalkqimnWCqKx.exe"C:\Users\Admin\AppData\LocalkqimnWCqKx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Roaming\Trojan.exe"C:\Users\Admin\AppData\Roaming\Trojan.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Trojan.exe" "Trojan.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalkqimnWCqKx.exeFilesize
43KB
MD536e991aab73aad00e464ba3e5fe09c81
SHA1b16e482cbfa7f27fe452c43c3af8e8158d8a1625
SHA25660433fd44d63261efa6557aa20a7be0b1c7975fbddcf0830ff61399e555f9cfa
SHA512e70a4a4b480dc26926c7feaecfda30533225a8e998f4f39724e17709cdb03422799539f1f944988d662d0352bed14750eb4b056fe8c087c3d7331a38aab93ea8
-
C:\Users\Admin\AppData\LocalkqimnWCqKx.exeFilesize
43KB
MD536e991aab73aad00e464ba3e5fe09c81
SHA1b16e482cbfa7f27fe452c43c3af8e8158d8a1625
SHA25660433fd44d63261efa6557aa20a7be0b1c7975fbddcf0830ff61399e555f9cfa
SHA512e70a4a4b480dc26926c7feaecfda30533225a8e998f4f39724e17709cdb03422799539f1f944988d662d0352bed14750eb4b056fe8c087c3d7331a38aab93ea8
-
C:\Users\Admin\AppData\Roaming\Trojan.exeFilesize
43KB
MD536e991aab73aad00e464ba3e5fe09c81
SHA1b16e482cbfa7f27fe452c43c3af8e8158d8a1625
SHA25660433fd44d63261efa6557aa20a7be0b1c7975fbddcf0830ff61399e555f9cfa
SHA512e70a4a4b480dc26926c7feaecfda30533225a8e998f4f39724e17709cdb03422799539f1f944988d662d0352bed14750eb4b056fe8c087c3d7331a38aab93ea8
-
C:\Users\Admin\AppData\Roaming\Trojan.exeFilesize
43KB
MD536e991aab73aad00e464ba3e5fe09c81
SHA1b16e482cbfa7f27fe452c43c3af8e8158d8a1625
SHA25660433fd44d63261efa6557aa20a7be0b1c7975fbddcf0830ff61399e555f9cfa
SHA512e70a4a4b480dc26926c7feaecfda30533225a8e998f4f39724e17709cdb03422799539f1f944988d662d0352bed14750eb4b056fe8c087c3d7331a38aab93ea8
-
\Users\Admin\AppData\Roaming\Trojan.exeFilesize
43KB
MD536e991aab73aad00e464ba3e5fe09c81
SHA1b16e482cbfa7f27fe452c43c3af8e8158d8a1625
SHA25660433fd44d63261efa6557aa20a7be0b1c7975fbddcf0830ff61399e555f9cfa
SHA512e70a4a4b480dc26926c7feaecfda30533225a8e998f4f39724e17709cdb03422799539f1f944988d662d0352bed14750eb4b056fe8c087c3d7331a38aab93ea8
-
memory/916-67-0x0000000000000000-mapping.dmp
-
memory/1344-60-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB
-
memory/1344-61-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/1344-56-0x0000000000000000-mapping.dmp
-
memory/1344-68-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/1788-63-0x0000000000000000-mapping.dmp
-
memory/1788-69-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/1788-71-0x00000000745F0000-0x0000000074B9B000-memory.dmpFilesize
5.7MB
-
memory/2036-59-0x0000000001120000-0x0000000001130000-memory.dmpFilesize
64KB
-
memory/2036-54-0x000007FEF3990000-0x000007FEF43B3000-memory.dmpFilesize
10.1MB
-
memory/2036-55-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmpFilesize
8KB