Analysis
-
max time kernel
149s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 17:53
Static task
static1
Behavioral task
behavioral1
Sample
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe
Resource
win7-20221111-en
General
-
Target
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe
-
Size
156KB
-
MD5
e1be214ce87788d6b58859e365a22e98
-
SHA1
6ef6b9744819e9ca50e68bfdd35f3bd0d63ec69e
-
SHA256
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2
-
SHA512
b86ca241fb1ce4de25dfd4c61cfefed3cda1d2f958644f66e29f68ee21f517b3990c184a205f787067bf05b29d58ff2b74c3a70a41a552f2d867b1465bf3cb2a
-
SSDEEP
3072:QB5CejoX8HmmFkzAEulAxBEsNIOQjUhm6my37RqQ9:KEnMtcpu6mO3r37RB
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exeandroidcompile.exeandroidcompile.exepid process 4428 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 4428 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 4760 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 4760 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 2760 androidcompile.exe 2760 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe 4976 androidcompile.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exepid process 4760 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exeandroidcompile.exedescription pid process target process PID 4428 wrote to memory of 4760 4428 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe PID 4428 wrote to memory of 4760 4428 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe PID 4428 wrote to memory of 4760 4428 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe 463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe PID 2760 wrote to memory of 4976 2760 androidcompile.exe androidcompile.exe PID 2760 wrote to memory of 4976 2760 androidcompile.exe androidcompile.exe PID 2760 wrote to memory of 4976 2760 androidcompile.exe androidcompile.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe"C:\Users\Admin\AppData\Local\Temp\463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe"C:\Users\Admin\AppData\Local\Temp\463593df99fc2b78736646c46e37047bd497b0641898b18ed5557fa43834a3c2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\androidcompile.exe"C:\Windows\SysWOW64\androidcompile.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\androidcompile.exe"C:\Windows\SysWOW64\androidcompile.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2760-148-0x00000000006C0000-0x00000000006D7000-memory.dmpFilesize
92KB
-
memory/2760-161-0x0000000000590000-0x00000000005A7000-memory.dmpFilesize
92KB
-
memory/2760-154-0x00000000006E0000-0x00000000006F0000-memory.dmpFilesize
64KB
-
memory/2760-153-0x0000000000590000-0x00000000005A7000-memory.dmpFilesize
92KB
-
memory/2760-152-0x00000000006C0000-0x00000000006D7000-memory.dmpFilesize
92KB
-
memory/4428-143-0x0000000000B70000-0x0000000000B87000-memory.dmpFilesize
92KB
-
memory/4428-132-0x00000000021C0000-0x00000000021D7000-memory.dmpFilesize
92KB
-
memory/4428-144-0x0000000000B90000-0x0000000000BA0000-memory.dmpFilesize
64KB
-
memory/4428-136-0x00000000021C0000-0x00000000021D7000-memory.dmpFilesize
92KB
-
memory/4760-162-0x00000000008B0000-0x00000000008C7000-memory.dmpFilesize
92KB
-
memory/4760-147-0x00000000008B0000-0x00000000008C7000-memory.dmpFilesize
92KB
-
memory/4760-142-0x00000000008D0000-0x00000000008E7000-memory.dmpFilesize
92KB
-
memory/4760-138-0x00000000008D0000-0x00000000008E7000-memory.dmpFilesize
92KB
-
memory/4760-137-0x0000000000000000-mapping.dmp
-
memory/4760-146-0x00000000005A0000-0x00000000005B0000-memory.dmpFilesize
64KB
-
memory/4760-145-0x00000000008B0000-0x00000000008C7000-memory.dmpFilesize
92KB
-
memory/4976-155-0x0000000000000000-mapping.dmp
-
memory/4976-156-0x00000000004F0000-0x0000000000507000-memory.dmpFilesize
92KB
-
memory/4976-160-0x00000000004F0000-0x0000000000507000-memory.dmpFilesize
92KB
-
memory/4976-163-0x00000000004D0000-0x00000000004E7000-memory.dmpFilesize
92KB
-
memory/4976-164-0x0000000000510000-0x0000000000520000-memory.dmpFilesize
64KB
-
memory/4976-165-0x00000000004D0000-0x00000000004E7000-memory.dmpFilesize
92KB