Analysis
-
max time kernel
119s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 04:30
Static task
static1
Behavioral task
behavioral1
Sample
211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe
Resource
win7-20221111-en
General
-
Target
211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe
-
Size
11.7MB
-
MD5
dd96f6c608015dfa158c635ade52ceaa
-
SHA1
b11c195ce9981ba88784c87bec5a9906dee9453a
-
SHA256
211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236
-
SHA512
f508e8a7c35007d69ff2817b132a8556d1804f616a532c4f0b50c2657f722ebf6f074a9d1612c6d14089efb4a0182bac21ad05debf013008cde2e6d8efea5bf6
-
SSDEEP
196608:iewJ9TUouhvSZFqJYOo/KprfA/o7e0gIoLYISoSptD/oEuZA8TRu+X1Q1zg6kIat:izIoumFqJboIsw7YLZMp+EuZZw+XO185
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nse8614.tmp\md5dll.dll acprotect \Users\Admin\AppData\Local\Temp\nse8614.tmp\md5dll.dll acprotect -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Executes dropped EXE 1 IoCs
Processes:
Xevodzbnlcuix.exepid process 1112 Xevodzbnlcuix.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nse8614.tmp\md5dll.dll upx \Users\Admin\AppData\Local\Temp\nse8614.tmp\md5dll.dll upx -
Loads dropped DLL 22 IoCs
Processes:
211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exeXevodzbnlcuix.exeWerFault.exepid process 992 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe 992 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe 992 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe 992 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 796 1112 WerFault.exe Xevodzbnlcuix.exe -
NSIS installer 8 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Xevodzbnlcuix.exepid process 1112 Xevodzbnlcuix.exe 1112 Xevodzbnlcuix.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exeXevodzbnlcuix.exedescription pid process target process PID 992 wrote to memory of 1112 992 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe Xevodzbnlcuix.exe PID 992 wrote to memory of 1112 992 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe Xevodzbnlcuix.exe PID 992 wrote to memory of 1112 992 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe Xevodzbnlcuix.exe PID 992 wrote to memory of 1112 992 211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe Xevodzbnlcuix.exe PID 1112 wrote to memory of 796 1112 Xevodzbnlcuix.exe WerFault.exe PID 1112 wrote to memory of 796 1112 Xevodzbnlcuix.exe WerFault.exe PID 1112 wrote to memory of 796 1112 Xevodzbnlcuix.exe WerFault.exe PID 1112 wrote to memory of 796 1112 Xevodzbnlcuix.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe"C:\Users\Admin\AppData\Local\Temp\211fcdf7216f8a3eeda1cbac14d991fc77049723c1194e4e32443daf55bc2236.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe"C:\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 5643⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exeFilesize
11.6MB
MD51d4084a96cdd87fac2c5b954fe5e0535
SHA184e770588f82db9ab0db7c484127b1e35c42ea19
SHA256a8470dd95f7021e212f23c8a22a8f0f93a637970906774c52309af5a4291b398
SHA512ee5e1805b3dea032871e6b55fcb2388121cbef9820033dba076fa56cc0525ded4cf62bfc9cb6e21857b796865358b65a1dd6695ac2017e7dde8febf78354310a
-
C:\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exeFilesize
11.6MB
MD51d4084a96cdd87fac2c5b954fe5e0535
SHA184e770588f82db9ab0db7c484127b1e35c42ea19
SHA256a8470dd95f7021e212f23c8a22a8f0f93a637970906774c52309af5a4291b398
SHA512ee5e1805b3dea032871e6b55fcb2388121cbef9820033dba076fa56cc0525ded4cf62bfc9cb6e21857b796865358b65a1dd6695ac2017e7dde8febf78354310a
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\InstallerUtils.dllFilesize
808KB
MD5f441c2d396c9ac80686516732eadd79a
SHA19616a904b7fe803b3c92ec440e858c0472a39a94
SHA256755f7ffb61fc871606bf0453bb7d5fbb3d68ad2cf2d28fff708b93193254cb52
SHA5127ad619cfb493de47b1426b6901fb8c200660bd90511387d143bd4ff440868e9e3beaaf5108eb8dc5771eb9363e5be2982dd2ab6b5ac5361bf39301f63c41c5d0
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\InstallerUtils.dllFilesize
808KB
MD5f441c2d396c9ac80686516732eadd79a
SHA19616a904b7fe803b3c92ec440e858c0472a39a94
SHA256755f7ffb61fc871606bf0453bb7d5fbb3d68ad2cf2d28fff708b93193254cb52
SHA5127ad619cfb493de47b1426b6901fb8c200660bd90511387d143bd4ff440868e9e3beaaf5108eb8dc5771eb9363e5be2982dd2ab6b5ac5361bf39301f63c41c5d0
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\InstallerUtils.dllFilesize
808KB
MD5f441c2d396c9ac80686516732eadd79a
SHA19616a904b7fe803b3c92ec440e858c0472a39a94
SHA256755f7ffb61fc871606bf0453bb7d5fbb3d68ad2cf2d28fff708b93193254cb52
SHA5127ad619cfb493de47b1426b6901fb8c200660bd90511387d143bd4ff440868e9e3beaaf5108eb8dc5771eb9363e5be2982dd2ab6b5ac5361bf39301f63c41c5d0
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\InstallerUtils.dllFilesize
808KB
MD5f441c2d396c9ac80686516732eadd79a
SHA19616a904b7fe803b3c92ec440e858c0472a39a94
SHA256755f7ffb61fc871606bf0453bb7d5fbb3d68ad2cf2d28fff708b93193254cb52
SHA5127ad619cfb493de47b1426b6901fb8c200660bd90511387d143bd4ff440868e9e3beaaf5108eb8dc5771eb9363e5be2982dd2ab6b5ac5361bf39301f63c41c5d0
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\InstallerUtils.dllFilesize
808KB
MD5f441c2d396c9ac80686516732eadd79a
SHA19616a904b7fe803b3c92ec440e858c0472a39a94
SHA256755f7ffb61fc871606bf0453bb7d5fbb3d68ad2cf2d28fff708b93193254cb52
SHA5127ad619cfb493de47b1426b6901fb8c200660bd90511387d143bd4ff440868e9e3beaaf5108eb8dc5771eb9363e5be2982dd2ab6b5ac5361bf39301f63c41c5d0
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\InstallerUtils.dllFilesize
808KB
MD5f441c2d396c9ac80686516732eadd79a
SHA19616a904b7fe803b3c92ec440e858c0472a39a94
SHA256755f7ffb61fc871606bf0453bb7d5fbb3d68ad2cf2d28fff708b93193254cb52
SHA5127ad619cfb493de47b1426b6901fb8c200660bd90511387d143bd4ff440868e9e3beaaf5108eb8dc5771eb9363e5be2982dd2ab6b5ac5361bf39301f63c41c5d0
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\InstallerUtils2.dllFilesize
94KB
MD5c0d21b7e25dcf3851962912aeeaf2bc7
SHA1121c91f50dcc34a53e6dcc473a34ce4e7f5c08bf
SHA256dc310b18405c5c48dca76b029ca255e6e5c21e0fa0fbe3bdb82482cdd32e423d
SHA51228b497e9f71001e64fc1d45e6449d9d06ec1dd290608d5474692144f616d94095f8dc5bfa0e5ebe711c6dae05839702f60c7bc19b067e53350806e5ceaae24ea
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\StdUtils.dllFilesize
14KB
MD521010df9bc37daffcc0b5ae190381d85
SHA1a8ba022aafc1233894db29e40e569dfc8b280eb9
SHA2560ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
SHA51295d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\System.dllFilesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\UserInfo.dllFilesize
4KB
MD57579ade7ae1747a31960a228ce02e666
SHA18ec8571a296737e819dcf86353a43fcf8ec63351
SHA256564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\md5dll.dllFilesize
6KB
MD50745ff646f5af1f1cdd784c06f40fce9
SHA1bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA256fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
SHA5128d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\md5dll.dllFilesize
6KB
MD50745ff646f5af1f1cdd784c06f40fce9
SHA1bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA256fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
SHA5128d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
-
\Users\Admin\AppData\Local\Temp\nse8614.tmp\nsisos.dllFilesize
5KB
MD569806691d649ef1c8703fd9e29231d44
SHA1e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA5125e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb
-
\Users\Admin\AppData\Local\Temp\nsoB109.tmp\StdUtils.dllFilesize
14KB
MD521010df9bc37daffcc0b5ae190381d85
SHA1a8ba022aafc1233894db29e40e569dfc8b280eb9
SHA2560ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
SHA51295d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
-
\Users\Admin\AppData\Local\Temp\nsoB109.tmp\System.dllFilesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
\Users\Admin\AppData\Local\Temp\nsoB109.tmp\WrapperUtils.dllFilesize
58KB
MD54ac6708c0f62f1d83465c11c936ba972
SHA1c1254513853147d3cb202cf4eae453ec6e3c2638
SHA25627c779c7856f5c18ed5ad2814bb05f441cb19791d5357f0dcd66b481a377316f
SHA51266ed34e64fcd6bddf5aea151dda9884337838312a35fb63d2a8190952659bbc9269cf63accd65887ca85c4f5df527bf02dc621550d92ca49d05a2ca104ee84c5
-
\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exeFilesize
11.6MB
MD51d4084a96cdd87fac2c5b954fe5e0535
SHA184e770588f82db9ab0db7c484127b1e35c42ea19
SHA256a8470dd95f7021e212f23c8a22a8f0f93a637970906774c52309af5a4291b398
SHA512ee5e1805b3dea032871e6b55fcb2388121cbef9820033dba076fa56cc0525ded4cf62bfc9cb6e21857b796865358b65a1dd6695ac2017e7dde8febf78354310a
-
\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exeFilesize
11.6MB
MD51d4084a96cdd87fac2c5b954fe5e0535
SHA184e770588f82db9ab0db7c484127b1e35c42ea19
SHA256a8470dd95f7021e212f23c8a22a8f0f93a637970906774c52309af5a4291b398
SHA512ee5e1805b3dea032871e6b55fcb2388121cbef9820033dba076fa56cc0525ded4cf62bfc9cb6e21857b796865358b65a1dd6695ac2017e7dde8febf78354310a
-
\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exeFilesize
11.6MB
MD51d4084a96cdd87fac2c5b954fe5e0535
SHA184e770588f82db9ab0db7c484127b1e35c42ea19
SHA256a8470dd95f7021e212f23c8a22a8f0f93a637970906774c52309af5a4291b398
SHA512ee5e1805b3dea032871e6b55fcb2388121cbef9820033dba076fa56cc0525ded4cf62bfc9cb6e21857b796865358b65a1dd6695ac2017e7dde8febf78354310a
-
\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exeFilesize
11.6MB
MD51d4084a96cdd87fac2c5b954fe5e0535
SHA184e770588f82db9ab0db7c484127b1e35c42ea19
SHA256a8470dd95f7021e212f23c8a22a8f0f93a637970906774c52309af5a4291b398
SHA512ee5e1805b3dea032871e6b55fcb2388121cbef9820033dba076fa56cc0525ded4cf62bfc9cb6e21857b796865358b65a1dd6695ac2017e7dde8febf78354310a
-
\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exeFilesize
11.6MB
MD51d4084a96cdd87fac2c5b954fe5e0535
SHA184e770588f82db9ab0db7c484127b1e35c42ea19
SHA256a8470dd95f7021e212f23c8a22a8f0f93a637970906774c52309af5a4291b398
SHA512ee5e1805b3dea032871e6b55fcb2388121cbef9820033dba076fa56cc0525ded4cf62bfc9cb6e21857b796865358b65a1dd6695ac2017e7dde8febf78354310a
-
\Users\Admin\AppData\Local\Temp\nsoB109.tmp\Xevodzbnlcuix.exeFilesize
11.6MB
MD51d4084a96cdd87fac2c5b954fe5e0535
SHA184e770588f82db9ab0db7c484127b1e35c42ea19
SHA256a8470dd95f7021e212f23c8a22a8f0f93a637970906774c52309af5a4291b398
SHA512ee5e1805b3dea032871e6b55fcb2388121cbef9820033dba076fa56cc0525ded4cf62bfc9cb6e21857b796865358b65a1dd6695ac2017e7dde8febf78354310a
-
memory/796-75-0x0000000000000000-mapping.dmp
-
memory/992-54-0x00000000767D1000-0x00000000767D3000-memory.dmpFilesize
8KB
-
memory/1112-59-0x0000000000000000-mapping.dmp
-
memory/1112-81-0x00000000003E0000-0x00000000003E9000-memory.dmpFilesize
36KB
-
memory/1112-82-0x00000000003E0000-0x00000000003E9000-memory.dmpFilesize
36KB
-
memory/1112-84-0x00000000003E0000-0x00000000003E9000-memory.dmpFilesize
36KB
-
memory/1112-85-0x00000000003E0000-0x00000000003E9000-memory.dmpFilesize
36KB