Analysis
-
max time kernel
175s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 12:53
Static task
static1
Behavioral task
behavioral1
Sample
OCT-NOV SOA2022.exe
Resource
win7-20220812-en
General
-
Target
OCT-NOV SOA2022.exe
-
Size
1.0MB
-
MD5
375cce397a6041917dbb29a8dd6bccf9
-
SHA1
c7e69aaed7928aa97611466a07175d7732f27f3a
-
SHA256
7fbaccd563b14340ac6f740cdfa6c0d83baceb824f11b6f27a393a1c9f2e2ed4
-
SHA512
58bba3144e21cd5e16e628b969be4c36fbe9e166770a0f8a37e91a665032b992fff7db788adf2bceccdc1acbbc1b780d89a443ade91b433a95a3e18e18b19eb4
-
SSDEEP
24576:yz4agh/awmjzQ1J7+tjdWbrk00j/UQ7tIihB52Dz:yz49h/dGE7KjdW/Kj/UBiE
Malware Config
Extracted
formbook
n2hm
XCeG4IxNKbAl
YzJWbnC+El84nA==
KAJcdmP8yEcO5LXPCFF42Wfb
I+J+xYO95GJQWVU=
GtgxPPv3FmQmhw==
Og9NYF4xEl+j7vGTR93xvg==
506Cg07bsT0G6yK+A96H0h35V+JLkwI=
wAYXFN+pSFIXgQ==
ijzLI/f+FmQmhw==
UfT2PweNm+w8
GQWVw5aZnfF/kS5e
30BKYjua9zcA7gAwsPUngLnjyrBNEgo=
AM65OrmyFmQmhw==
VSlTVxISZ4J/kS5e
GGKj6K33SRh6e0/YzT5nQGlK5CXRqw==
B9H98cUUfX+AWOqiTA==
MxVffWOIoVnM37zrd2sTaOY=
z6bxCgG/mGhR7oDzQA==
pQgSLSRi6AK3M/PdArpX
6rRRsYuSnXx/kS5e
tJRNn0ias3Yw
7c4NEQLSp/R/kS5e
TJmwu5Aa/IuRHtoXXQ==
TLoRUygkiJQE5GoRji0aff0=
Y83qB/DsQFYeZzahj6pYqw==
Bup2q3PHFmQmhw==
cDTa78WEWaYMdoDdArpX
28Rw4MRMnjT52raaTR5KhtMJYa8=
WydpZS7v/4XubCZuhkdxP2OAKdyK68u6
B+osKudaL8yAV/K/VAH3T+Q=
qVz9Y0QD3TGeM/PdArpX
+r49VzlFXLpFegdyc4q5ow==
gsXk990afa1hl6ATTA==
XkblOQWRaet/kS5e
4TNPSf2OcfNk9cfPCFF42Wfb
NaIIUEoRdKYr
ITSqBfn5FmQmhw==
KPRUmWnqxVE0hERFtyo=
VLzd1qk6E5wNcQ49KnmhAoT3Ok5roMK4kQ==
65jM2pKJ8EIST04=
I3+JoYVgYgDiv3O15Ntvw0On/sJroMK4kQ==
C+YhNzH20aCpy8MqVw==
yBZRl4HdPn+RHtoXXQ==
pGQATg0mMfntSBR9c4q5ow==
YUKFixIRdKYr
Hv+C4cZTOMAKV+/dArpX
MVW+PJpyCVA=
FX2AJYBFYbgk
/cX1CsjSpvU+
fWoThWagDVhBHt4yMjWQifM=
/vCd69xrS8QwuCt/yD8=
GvAsSzbCRxplG582TKzVug==
S6zlGfJ6DFc4TBNUvig=
k0z/QwnTpfR/kS5e
KPofKfkPcoRqxowFuWWNhvM=
Xrj+JvENc3yBln4OUw==
ScTatpYj/IKRHtoXXQ==
vLRdwbLyTpzFn+dAR93xvg==
mLTJe/eFp2kxl69W
Cbr5/dRQbio2P/e8ay0aff0=
xooviWn51V7DI7mMOwWT4lCIJUlf
l0t7fTmLqSCAuIYIVA==
06xFejwYMSkbfETTiNT21O0=
bWzTF+1nS4kxlydW
madamkikkiey.net
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
OCT-NOV SOA2022.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation OCT-NOV SOA2022.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
OCT-NOV SOA2022.exeOCT-NOV SOA2022.exehelp.exedescription pid process target process PID 444 set thread context of 4632 444 OCT-NOV SOA2022.exe OCT-NOV SOA2022.exe PID 4632 set thread context of 2644 4632 OCT-NOV SOA2022.exe Explorer.EXE PID 4632 set thread context of 2644 4632 OCT-NOV SOA2022.exe Explorer.EXE PID 4936 set thread context of 2644 4936 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
OCT-NOV SOA2022.exehelp.exepid process 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4936 help.exe 4936 help.exe 4936 help.exe 4936 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
OCT-NOV SOA2022.exehelp.exepid process 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4632 OCT-NOV SOA2022.exe 4936 help.exe 4936 help.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
OCT-NOV SOA2022.exeExplorer.EXEhelp.exedescription pid process Token: SeDebugPrivilege 4632 OCT-NOV SOA2022.exe Token: SeShutdownPrivilege 2644 Explorer.EXE Token: SeCreatePagefilePrivilege 2644 Explorer.EXE Token: SeDebugPrivilege 4936 help.exe Token: SeShutdownPrivilege 2644 Explorer.EXE Token: SeCreatePagefilePrivilege 2644 Explorer.EXE Token: SeShutdownPrivilege 2644 Explorer.EXE Token: SeCreatePagefilePrivilege 2644 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
OCT-NOV SOA2022.exeExplorer.EXEOCT-NOV SOA2022.exedescription pid process target process PID 444 wrote to memory of 4632 444 OCT-NOV SOA2022.exe OCT-NOV SOA2022.exe PID 444 wrote to memory of 4632 444 OCT-NOV SOA2022.exe OCT-NOV SOA2022.exe PID 444 wrote to memory of 4632 444 OCT-NOV SOA2022.exe OCT-NOV SOA2022.exe PID 444 wrote to memory of 4632 444 OCT-NOV SOA2022.exe OCT-NOV SOA2022.exe PID 444 wrote to memory of 4632 444 OCT-NOV SOA2022.exe OCT-NOV SOA2022.exe PID 444 wrote to memory of 4632 444 OCT-NOV SOA2022.exe OCT-NOV SOA2022.exe PID 2644 wrote to memory of 3648 2644 Explorer.EXE cscript.exe PID 2644 wrote to memory of 3648 2644 Explorer.EXE cscript.exe PID 2644 wrote to memory of 3648 2644 Explorer.EXE cscript.exe PID 4632 wrote to memory of 4936 4632 OCT-NOV SOA2022.exe help.exe PID 4632 wrote to memory of 4936 4632 OCT-NOV SOA2022.exe help.exe PID 4632 wrote to memory of 4936 4632 OCT-NOV SOA2022.exe help.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\OCT-NOV SOA2022.exe"C:\Users\Admin\AppData\Local\Temp\OCT-NOV SOA2022.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\OCT-NOV SOA2022.exe"C:\Users\Admin\AppData\Local\Temp\OCT-NOV SOA2022.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4936 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵PID:3648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/444-132-0x0000000000480000-0x0000000000592000-memory.dmpFilesize
1.1MB
-
memory/444-133-0x00000000055E0000-0x0000000005B84000-memory.dmpFilesize
5.6MB
-
memory/444-135-0x0000000004FE0000-0x0000000004FEA000-memory.dmpFilesize
40KB
-
memory/444-134-0x0000000004F30000-0x0000000004FC2000-memory.dmpFilesize
584KB
-
memory/444-136-0x0000000007500000-0x000000000759C000-memory.dmpFilesize
624KB
-
memory/2644-167-0x00000000033E0000-0x0000000003479000-memory.dmpFilesize
612KB
-
memory/2644-166-0x00000000030E0000-0x00000000030F0000-memory.dmpFilesize
64KB
-
memory/2644-165-0x00000000030E0000-0x00000000030F0000-memory.dmpFilesize
64KB
-
memory/2644-157-0x00000000030E0000-0x00000000030F0000-memory.dmpFilesize
64KB
-
memory/2644-163-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-164-0x00000000030E0000-0x00000000030F0000-memory.dmpFilesize
64KB
-
memory/2644-161-0x00000000033E0000-0x0000000003479000-memory.dmpFilesize
612KB
-
memory/2644-145-0x0000000003320000-0x00000000033DD000-memory.dmpFilesize
756KB
-
memory/2644-159-0x00000000030E0000-0x00000000030F0000-memory.dmpFilesize
64KB
-
memory/2644-148-0x0000000008560000-0x0000000008676000-memory.dmpFilesize
1.1MB
-
memory/2644-158-0x00000000030E0000-0x00000000030F0000-memory.dmpFilesize
64KB
-
memory/2644-156-0x00000000030D0000-0x00000000030E0000-memory.dmpFilesize
64KB
-
memory/2644-155-0x0000000003080000-0x0000000003090000-memory.dmpFilesize
64KB
-
memory/4632-142-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4632-143-0x0000000001680000-0x00000000019CA000-memory.dmpFilesize
3.3MB
-
memory/4632-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4632-137-0x0000000000000000-mapping.dmp
-
memory/4632-140-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4632-150-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/4632-149-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4632-147-0x00000000032A0000-0x00000000032B0000-memory.dmpFilesize
64KB
-
memory/4632-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4632-144-0x0000000001210000-0x0000000001220000-memory.dmpFilesize
64KB
-
memory/4936-151-0x0000000000000000-mapping.dmp
-
memory/4936-162-0x0000000000130000-0x000000000015D000-memory.dmpFilesize
180KB
-
memory/4936-160-0x0000000000A20000-0x0000000000AAF000-memory.dmpFilesize
572KB
-
memory/4936-153-0x0000000000BE0000-0x0000000000F2A000-memory.dmpFilesize
3.3MB
-
memory/4936-152-0x0000000000570000-0x0000000000577000-memory.dmpFilesize
28KB
-
memory/4936-154-0x0000000000130000-0x000000000015D000-memory.dmpFilesize
180KB