b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6

General

Target

b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
Size

223KB
MD5

735764c37b0379f8502c4951ed9e6559
SHA1

c24b548c5b73b8cb9fef6501831a4a88c0c56def
SHA256

b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6
SHA512

14f91039d3dcb461b852f6bf739902a3d3265e6dcc7b25a7e8669771918ac9e639a3a55026cbd46ca298748c35074200bc8edeec00aa55110052259e79c451c2
SSDEEP

6144:OJezGriexb7MH75mYgE8ki53ZJSgKa+p8nOnn:6A8m453ZsZalOnn

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-56-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/2036-58-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral1/memory/1180-61-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1180-63-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1180-64-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1180-67-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1180-68-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1180-74-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2036-86-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 1180	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	30
PID 2036 set thread context of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
2008	ipconfig.exe
760	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2008	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	28
PID 2036 wrote to memory of 2008	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	28
PID 2036 wrote to memory of 2008	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	28
PID 2036 wrote to memory of 2008	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	28
PID 2036 wrote to memory of 1180	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	30
PID 2036 wrote to memory of 1180	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	30
PID 2036 wrote to memory of 1180	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	30
PID 2036 wrote to memory of 1180	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	30
PID 2036 wrote to memory of 1180	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	30
PID 2036 wrote to memory of 1180	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	30
PID 2036 wrote to memory of 1180	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	30
PID 2036 wrote to memory of 1180	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	30
PID 1180 wrote to memory of 760	1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	31
PID 1180 wrote to memory of 760	1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	31
PID 1180 wrote to memory of 760	1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	31
PID 1180 wrote to memory of 760	1180	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	31
PID 2036 wrote to memory of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33
PID 2036 wrote to memory of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33
PID 2036 wrote to memory of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33
PID 2036 wrote to memory of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33
PID 2036 wrote to memory of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33
PID 2036 wrote to memory of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33
PID 2036 wrote to memory of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33
PID 2036 wrote to memory of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33
PID 2036 wrote to memory of 1244	2036	b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe	33

C:\Users\Admin\AppData\Local\Temp\b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
"C:\Users\Admin\AppData\Local\Temp\b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe" /release
  2⤵
  - Gathers network information
  PID:2008
- C:\Users\Admin\AppData\Local\Temp\b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
  "C:\Users\Admin\AppData\Local\Temp\b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /renew
    3⤵
    - Gathers network information
    PID:760
- C:\Users\Admin\AppData\Local\Temp\b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe
  "C:\Users\Admin\AppData\Local\Temp\b9c2df35cc94e12e456cbcb7fc3340e41c64dd64c2473be9cafc280a0e834ce6.exe"
  2⤵
  PID:1244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-68-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1180-74-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1180-67-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1180-61-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1180-60-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1180-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1180-64-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1244-75-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1244-76-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1244-81-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1244-79-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1244-78-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1244-87-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2036-56-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2036-58-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2036-57-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/2036-86-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2036-82-0x0000000003310000-0x000000000338B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing