Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:52
Static task
static1
Behavioral task
behavioral1
Sample
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe
Resource
win10v2004-20220812-en
General
-
Target
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe
-
Size
164KB
-
MD5
0f5429b431338533ba71edfe7a0538d9
-
SHA1
4d5e2795f8ea068c3eb543b56eda592ecddb671c
-
SHA256
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd
-
SHA512
a96e1e28b8de2f4a9f58dd5009ff4775664c38791dbb7f95a60b887527256aae27edd53a50f487a1b8e4d7982b8a09442fd1f47b94abaa850dbd2cc088c9bbff
-
SSDEEP
3072:ulRGkuKeuPeruBYAG5IqMryVOPz1Gz2YA+d1WfLIj9iKs75J9CLWDQbzKQ:ulRGkunseruBYAG5IqyeOPzYKN2WfEjH
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
LocalkqimnWCqKx.exeTrojan.exepid process 4676 LocalkqimnWCqKx.exe 5112 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exeLocalkqimnWCqKx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation LocalkqimnWCqKx.exe -
Drops startup file 2 IoCs
Processes:
Trojan.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8515eb34d8f9de5af815466e9715b3e5.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8515eb34d8f9de5af815466e9715b3e5.exe Trojan.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8515eb34d8f9de5af815466e9715b3e5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8515eb34d8f9de5af815466e9715b3e5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
Trojan.exepid process 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe 5112 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 5112 Trojan.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exeLocalkqimnWCqKx.exeTrojan.exedescription pid process target process PID 2556 wrote to memory of 4676 2556 57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe LocalkqimnWCqKx.exe PID 2556 wrote to memory of 4676 2556 57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe LocalkqimnWCqKx.exe PID 2556 wrote to memory of 4676 2556 57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe LocalkqimnWCqKx.exe PID 4676 wrote to memory of 5112 4676 LocalkqimnWCqKx.exe Trojan.exe PID 4676 wrote to memory of 5112 4676 LocalkqimnWCqKx.exe Trojan.exe PID 4676 wrote to memory of 5112 4676 LocalkqimnWCqKx.exe Trojan.exe PID 5112 wrote to memory of 4708 5112 Trojan.exe netsh.exe PID 5112 wrote to memory of 4708 5112 Trojan.exe netsh.exe PID 5112 wrote to memory of 4708 5112 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe"C:\Users\Admin\AppData\Local\Temp\57822bd9e19b89890a9b4b8e31cb798b9af9e24ecf40d3daff86ca4ea91127cd.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\LocalkqimnWCqKx.exe"C:\Users\Admin\AppData\LocalkqimnWCqKx.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Roaming\Trojan.exe"C:\Users\Admin\AppData\Roaming\Trojan.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Trojan.exe" "Trojan.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:4708
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalkqimnWCqKx.exeFilesize
43KB
MD536e991aab73aad00e464ba3e5fe09c81
SHA1b16e482cbfa7f27fe452c43c3af8e8158d8a1625
SHA25660433fd44d63261efa6557aa20a7be0b1c7975fbddcf0830ff61399e555f9cfa
SHA512e70a4a4b480dc26926c7feaecfda30533225a8e998f4f39724e17709cdb03422799539f1f944988d662d0352bed14750eb4b056fe8c087c3d7331a38aab93ea8
-
C:\Users\Admin\AppData\LocalkqimnWCqKx.exeFilesize
43KB
MD536e991aab73aad00e464ba3e5fe09c81
SHA1b16e482cbfa7f27fe452c43c3af8e8158d8a1625
SHA25660433fd44d63261efa6557aa20a7be0b1c7975fbddcf0830ff61399e555f9cfa
SHA512e70a4a4b480dc26926c7feaecfda30533225a8e998f4f39724e17709cdb03422799539f1f944988d662d0352bed14750eb4b056fe8c087c3d7331a38aab93ea8
-
C:\Users\Admin\AppData\Roaming\Trojan.exeFilesize
43KB
MD536e991aab73aad00e464ba3e5fe09c81
SHA1b16e482cbfa7f27fe452c43c3af8e8158d8a1625
SHA25660433fd44d63261efa6557aa20a7be0b1c7975fbddcf0830ff61399e555f9cfa
SHA512e70a4a4b480dc26926c7feaecfda30533225a8e998f4f39724e17709cdb03422799539f1f944988d662d0352bed14750eb4b056fe8c087c3d7331a38aab93ea8
-
C:\Users\Admin\AppData\Roaming\Trojan.exeFilesize
43KB
MD536e991aab73aad00e464ba3e5fe09c81
SHA1b16e482cbfa7f27fe452c43c3af8e8158d8a1625
SHA25660433fd44d63261efa6557aa20a7be0b1c7975fbddcf0830ff61399e555f9cfa
SHA512e70a4a4b480dc26926c7feaecfda30533225a8e998f4f39724e17709cdb03422799539f1f944988d662d0352bed14750eb4b056fe8c087c3d7331a38aab93ea8
-
memory/2556-132-0x00007FFD7C670000-0x00007FFD7D0A6000-memory.dmpFilesize
10.2MB
-
memory/4676-133-0x0000000000000000-mapping.dmp
-
memory/4676-136-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/4676-140-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/4708-141-0x0000000000000000-mapping.dmp
-
memory/5112-137-0x0000000000000000-mapping.dmp
-
memory/5112-142-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/5112-143-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB