Analysis
-
max time kernel
160s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 05:18
Static task
static1
Behavioral task
behavioral1
Sample
kCGCNKYCnqgQSEJ.exe
Resource
win7-20221111-en
General
-
Target
kCGCNKYCnqgQSEJ.exe
-
Size
552KB
-
MD5
e823afd1e909b794b2f2602ecadd15cc
-
SHA1
4c6d24c796faebc2b54f981e2f8127187b08aa4b
-
SHA256
33709e54333a4b6cc832c1cfbc3eae6d7c256642931f2fb6e47d26bb2d191cfa
-
SHA512
8a45b1d0910ad632a73f3d23d5c3dc63f745ffb3e318c91f4826a80666c983d5308abec58f708749124a84e101c97f6302ad3c2320016cbc18bfe8092a9e20b1
-
SSDEEP
6144:KoLEvklriDeOCH0IG0ocHtIgzH7R4u8pHrjstXlTna84yMDFqrnHKzYPrAV3+go4:FGqGNoC4P8Lj87QyMUjHZi3+U49jq
Malware Config
Extracted
formbook
rjwn
03o7kR/VYOT8r06ry8Ku
nhzRGt5dmI+rX14=
fxLQJLh1IdH3jGuZ1KBvy/sK4Q==
GAU9GqrQnwWRKMfS7KTmrg==
xyidkidiZ/CAIrOchLc38Ckd
qpaUZjfKUOAKBI+C1Q==
tn919W/lRcHaoraZK53frA==
zEQOdA3OY/EHnYvF7KTmrg==
MJALDhT0sw68hUTcnNMUVI/EiWY=
FwpKMs0PRYvGVxbSy3mxZtw=
9IBBwo1zU45kK0M=
baAZGqfBu1HmiS0OWuM38Ckd
+fUxM/QxXJmvPfzwdUI=
WZYOXSolDIEOz9lzR0c4UAA71p19tw==
n6Hftzs+TYbFBI+C1Q==
UdyBA9GXFou2hZJ1/W9ihcM=
jrgyH63jDVl3Rg3KVAhYg8M=
74f/sGdLgw0RrxLszsOs
rivUOgDVVdIGBI+C1Q==
eZ0hfm//kK/IgQ==
cOyWB9nBcLJgIe6MJJvysw==
uuQW3nDB5zE515iu7KTmrg==
kFZItj/PTXLXvV/8
SdWV6XEb4CxVA9IKhEeUMtU=
ZA7+YCScoo5kK0M=
xxqaB+Xv22QHm3sV5tiojr32e5kr
we10urhAkK/IgQ==
xHIjiT/6dZAk5qwj/e66jNIRzmJfb+4=
tpqPy81EkK/IgQ==
H/oAAuNh2mF6Ee0gmT6EHyc21p19tw==
DhpG0lPF+kwtG+IoGEo=
rkbubjj5dfvXvV/8
MhD5hGFD1uWFOUCE+nhi4kjTm2c=
28ayIatEvUVU/vmry8Ku
44uffAYW0BW/e0qry8Ku
+oQ4mmlmUY5kK0M=
9z2xkR1bUs1K3oWu7KTmrg==
m2db2VOl9S+XaWJdMWOm
73QkNsjpCEltIvzwdUI=
sW9l0ms9+T7Wk2Pxyr0ESkjTm2c=
dQm1EeTrtAeTJQO1n6oFSkjTm2c=
MMqG+Lp7YV/khkury8Ku
caIijU4NhQUdwBwjf1U=
DenkusP7awDXvV/8
rd9aXuDl1m4GqU5/Cr4sLQEL6Q==
j+BfT9DNkYp7KVQ=
imNRxEzwW8rcoVSry8Ku
UwClcUVdKmf8
2Uz8cjgFrA2TJcXS7KTmrg==
6WYjegWsL8PUjJGv3FOjIUjTm2c=
t0L8aveKFCI216+je6z3sA==
iroxmGIq0Rm3d0ury8Ku
YHi4soTzVY65ziSry8Ku
neFeYuPHd7n+v7uxi80sLQEL6Q==
jfm1IeWzNK22a2qCfLwqLQEL6Q==
LF/Hwz0h2Su9cGUbBgT1BFFqRl8ug/iX
pZvZ78UYM3U+0H4B0xRqVR0S5H/8vw==
rcQA7r4oVYmULtrS7KTmrg==
RX73/YB1XulzJPzwdUI=
EZ5jwEvwdgkluZiw1KBvy/sK4Q==
+5ytLx8LkZDGBI+C1Q==
N+/jWNuSgsXZhw==
6dXR+ICNgA2vR/xdkd0lMsgV
Qsh6jhYVA5YvtYwqAQk38Ckd
volpiventure.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
kCGCNKYCnqgQSEJ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation kCGCNKYCnqgQSEJ.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
kCGCNKYCnqgQSEJ.exekCGCNKYCnqgQSEJ.exesvchost.exedescription pid process target process PID 5084 set thread context of 2832 5084 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 2832 set thread context of 1192 2832 kCGCNKYCnqgQSEJ.exe Explorer.EXE PID 4256 set thread context of 1192 4256 svchost.exe Explorer.EXE -
Processes:
svchost.exedescription ioc process Key created \Registry\User\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
kCGCNKYCnqgQSEJ.exesvchost.exepid process 2832 kCGCNKYCnqgQSEJ.exe 2832 kCGCNKYCnqgQSEJ.exe 2832 kCGCNKYCnqgQSEJ.exe 2832 kCGCNKYCnqgQSEJ.exe 2832 kCGCNKYCnqgQSEJ.exe 2832 kCGCNKYCnqgQSEJ.exe 2832 kCGCNKYCnqgQSEJ.exe 2832 kCGCNKYCnqgQSEJ.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
kCGCNKYCnqgQSEJ.exesvchost.exepid process 2832 kCGCNKYCnqgQSEJ.exe 2832 kCGCNKYCnqgQSEJ.exe 2832 kCGCNKYCnqgQSEJ.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe 4256 svchost.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
kCGCNKYCnqgQSEJ.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2832 kCGCNKYCnqgQSEJ.exe Token: SeDebugPrivilege 4256 svchost.exe Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeCreatePagefilePrivilege 1192 Explorer.EXE Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeCreatePagefilePrivilege 1192 Explorer.EXE Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeCreatePagefilePrivilege 1192 Explorer.EXE Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeCreatePagefilePrivilege 1192 Explorer.EXE Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeCreatePagefilePrivilege 1192 Explorer.EXE Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeCreatePagefilePrivilege 1192 Explorer.EXE Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeCreatePagefilePrivilege 1192 Explorer.EXE Token: SeShutdownPrivilege 1192 Explorer.EXE Token: SeCreatePagefilePrivilege 1192 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
kCGCNKYCnqgQSEJ.exeExplorer.EXEsvchost.exedescription pid process target process PID 5084 wrote to memory of 2832 5084 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 5084 wrote to memory of 2832 5084 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 5084 wrote to memory of 2832 5084 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 5084 wrote to memory of 2832 5084 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 5084 wrote to memory of 2832 5084 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 5084 wrote to memory of 2832 5084 kCGCNKYCnqgQSEJ.exe kCGCNKYCnqgQSEJ.exe PID 1192 wrote to memory of 4256 1192 Explorer.EXE svchost.exe PID 1192 wrote to memory of 4256 1192 Explorer.EXE svchost.exe PID 1192 wrote to memory of 4256 1192 Explorer.EXE svchost.exe PID 4256 wrote to memory of 1660 4256 svchost.exe Firefox.exe PID 4256 wrote to memory of 1660 4256 svchost.exe Firefox.exe PID 4256 wrote to memory of 1660 4256 svchost.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\kCGCNKYCnqgQSEJ.exe"C:\Users\Admin\AppData\Local\Temp\kCGCNKYCnqgQSEJ.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\kCGCNKYCnqgQSEJ.exe"C:\Users\Admin\AppData\Local\Temp\kCGCNKYCnqgQSEJ.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1660
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1192-156-0x0000000002520000-0x0000000002611000-memory.dmpFilesize
964KB
-
memory/1192-155-0x0000000002520000-0x0000000002611000-memory.dmpFilesize
964KB
-
memory/1192-146-0x0000000007D80000-0x0000000007E87000-memory.dmpFilesize
1.0MB
-
memory/2832-145-0x0000000001050000-0x0000000001060000-memory.dmpFilesize
64KB
-
memory/2832-148-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2832-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2832-138-0x0000000000000000-mapping.dmp
-
memory/2832-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2832-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2832-142-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/2832-144-0x00000000016A0000-0x00000000019EA000-memory.dmpFilesize
3.3MB
-
memory/4256-149-0x0000000000000000-mapping.dmp
-
memory/4256-150-0x00000000008F0000-0x00000000008FE000-memory.dmpFilesize
56KB
-
memory/4256-151-0x0000000000600000-0x000000000062D000-memory.dmpFilesize
180KB
-
memory/4256-152-0x0000000001200000-0x000000000154A000-memory.dmpFilesize
3.3MB
-
memory/4256-153-0x0000000000600000-0x000000000062D000-memory.dmpFilesize
180KB
-
memory/4256-154-0x0000000000900000-0x000000000098F000-memory.dmpFilesize
572KB
-
memory/5084-137-0x0000000007800000-0x000000000789C000-memory.dmpFilesize
624KB
-
memory/5084-136-0x0000000005170000-0x000000000517A000-memory.dmpFilesize
40KB
-
memory/5084-135-0x0000000005320000-0x00000000054C6000-memory.dmpFilesize
1.6MB
-
memory/5084-132-0x0000000000580000-0x000000000060A000-memory.dmpFilesize
552KB
-
memory/5084-134-0x0000000004FA0000-0x0000000005032000-memory.dmpFilesize
584KB
-
memory/5084-133-0x0000000005620000-0x0000000005BC4000-memory.dmpFilesize
5.6MB