Analysis
-
max time kernel
263s -
max time network
318s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 17:36
Static task
static1
Behavioral task
behavioral1
Sample
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe
Resource
win10v2004-20221111-en
General
-
Target
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe
-
Size
180KB
-
MD5
9ad02f7a000557841df40137de302ad7
-
SHA1
73a57c739a63126bf519690cbb6e5524d6cb1f47
-
SHA256
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
-
SHA512
510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b
-
SSDEEP
3072:1l4v+FlO+cPtrcfC3czXwlZqJwmHDquZfFrvQKvu5aLMN4yN6sZqJwmHDquZf+:1lkXztwYiwlZqJwmHDquZfFrvQKvu5aE
Malware Config
Extracted
tofsee
89.149.236.147
188.165.132.183
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ltkgcph.exeltkgcph.exepid process 3976 ltkgcph.exe 4736 ltkgcph.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\ltkgcph.exe\" /r" b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exeltkgcph.exeltkgcph.exedescription pid process target process PID 4060 set thread context of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 3976 set thread context of 4736 3976 ltkgcph.exe ltkgcph.exe PID 4736 set thread context of 4960 4736 ltkgcph.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exeb2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exeltkgcph.exeltkgcph.exedescription pid process target process PID 4060 wrote to memory of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 4060 wrote to memory of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 4060 wrote to memory of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 4060 wrote to memory of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 4060 wrote to memory of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 4060 wrote to memory of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 4060 wrote to memory of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 4060 wrote to memory of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 4060 wrote to memory of 1324 4060 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe PID 1324 wrote to memory of 3976 1324 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe ltkgcph.exe PID 1324 wrote to memory of 3976 1324 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe ltkgcph.exe PID 1324 wrote to memory of 3976 1324 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe ltkgcph.exe PID 3976 wrote to memory of 4736 3976 ltkgcph.exe ltkgcph.exe PID 3976 wrote to memory of 4736 3976 ltkgcph.exe ltkgcph.exe PID 3976 wrote to memory of 4736 3976 ltkgcph.exe ltkgcph.exe PID 3976 wrote to memory of 4736 3976 ltkgcph.exe ltkgcph.exe PID 3976 wrote to memory of 4736 3976 ltkgcph.exe ltkgcph.exe PID 3976 wrote to memory of 4736 3976 ltkgcph.exe ltkgcph.exe PID 3976 wrote to memory of 4736 3976 ltkgcph.exe ltkgcph.exe PID 3976 wrote to memory of 4736 3976 ltkgcph.exe ltkgcph.exe PID 3976 wrote to memory of 4736 3976 ltkgcph.exe ltkgcph.exe PID 4736 wrote to memory of 4960 4736 ltkgcph.exe svchost.exe PID 4736 wrote to memory of 4960 4736 ltkgcph.exe svchost.exe PID 4736 wrote to memory of 4960 4736 ltkgcph.exe svchost.exe PID 4736 wrote to memory of 4960 4736 ltkgcph.exe svchost.exe PID 4736 wrote to memory of 4960 4736 ltkgcph.exe svchost.exe PID 1324 wrote to memory of 2728 1324 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe cmd.exe PID 1324 wrote to memory of 2728 1324 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe cmd.exe PID 1324 wrote to memory of 2728 1324 b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe"C:\Users\Admin\AppData\Local\Temp\b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe"C:\Users\Admin\AppData\Local\Temp\b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\ltkgcph.exe"C:\Users\Admin\ltkgcph.exe" /r3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\ltkgcph.exe"C:\Users\Admin\ltkgcph.exe" /r4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7318.bat" "3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4960 -ip 49601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7318.batFilesize
135B
MD524b777478a14cf527d10f71ea8058cad
SHA152e2ef197753d4256c037e7fbbbf56cb48aa2d79
SHA256dc2a2fc30eb20ab79a3c5c5806445ca8bd786b4561e20d5db1af62c0f101fdb3
SHA512abd4a959985839c4be74a52c413a038bb2138fc18cbf967f84227f10e9dc8cd24ef2653829900fabed1840222d7d67486a74d4ece193f903475c23f6d47f0587
-
C:\Users\Admin\ltkgcph.exeFilesize
180KB
MD59ad02f7a000557841df40137de302ad7
SHA173a57c739a63126bf519690cbb6e5524d6cb1f47
SHA256b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
SHA512510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b
-
C:\Users\Admin\ltkgcph.exeFilesize
180KB
MD59ad02f7a000557841df40137de302ad7
SHA173a57c739a63126bf519690cbb6e5524d6cb1f47
SHA256b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
SHA512510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b
-
C:\Users\Admin\ltkgcph.exeFilesize
180KB
MD59ad02f7a000557841df40137de302ad7
SHA173a57c739a63126bf519690cbb6e5524d6cb1f47
SHA256b2c822b5eaef23f2e2f3c41dbe792df502c9818f85e595450b4934fffae98213
SHA512510b581436db23623f228ee0a2b2ed8cb28f6fc8cbedf11243d60a3eb31ff7909dce0c3ae93ef0f913d4023807e3ff5d377b324b2c78f261997003012a91369b
-
memory/1324-134-0x0000000000000000-mapping.dmp
-
memory/1324-135-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1324-138-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1324-148-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/2728-155-0x0000000000000000-mapping.dmp
-
memory/3976-139-0x0000000000000000-mapping.dmp
-
memory/3976-146-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4060-133-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4060-137-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4736-142-0x0000000000000000-mapping.dmp
-
memory/4960-153-0x0000000000660000-0x0000000000683000-memory.dmpFilesize
140KB
-
memory/4960-154-0x0000000000660000-0x0000000000683000-memory.dmpFilesize
140KB
-
memory/4960-150-0x0000000000660000-0x0000000000683000-memory.dmpFilesize
140KB
-
memory/4960-149-0x0000000000000000-mapping.dmp