Analysis
-
max time kernel
88s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 01:10
Static task
static1
Behavioral task
behavioral1
Sample
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe
Resource
win10v2004-20221111-en
General
-
Target
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe
-
Size
189KB
-
MD5
eeb7e6c7f4ab9c7830b11f7fd7fd2011
-
SHA1
beb0384bd419447ab753de454e8d071923928e98
-
SHA256
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
-
SHA512
ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
SSDEEP
3072:w7F7r/UFftCzKka2Y2dMOSbSl8+pOW3jfSgDdB:88F2BdbjbbjzDf
Malware Config
Extracted
tofsee
91.121.4.118
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
khlskhs.exekhlskhs.exepid process 468 khlskhs.exe 520 khlskhs.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 364 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exepid process 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\khlskhs.exe\" /r" c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exekhlskhs.exekhlskhs.exedescription pid process target process PID 1200 set thread context of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 468 set thread context of 520 468 khlskhs.exe khlskhs.exe PID 520 set thread context of 1852 520 khlskhs.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exec768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exekhlskhs.exekhlskhs.exedescription pid process target process PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 1200 wrote to memory of 840 1200 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe PID 840 wrote to memory of 468 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe khlskhs.exe PID 840 wrote to memory of 468 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe khlskhs.exe PID 840 wrote to memory of 468 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe khlskhs.exe PID 840 wrote to memory of 468 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 468 wrote to memory of 520 468 khlskhs.exe khlskhs.exe PID 520 wrote to memory of 1852 520 khlskhs.exe svchost.exe PID 520 wrote to memory of 1852 520 khlskhs.exe svchost.exe PID 520 wrote to memory of 1852 520 khlskhs.exe svchost.exe PID 520 wrote to memory of 1852 520 khlskhs.exe svchost.exe PID 520 wrote to memory of 1852 520 khlskhs.exe svchost.exe PID 520 wrote to memory of 1852 520 khlskhs.exe svchost.exe PID 840 wrote to memory of 364 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe cmd.exe PID 840 wrote to memory of 364 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe cmd.exe PID 840 wrote to memory of 364 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe cmd.exe PID 840 wrote to memory of 364 840 c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe"C:\Users\Admin\AppData\Local\Temp\c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe"C:\Users\Admin\AppData\Local\Temp\c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\khlskhs.exe"C:\Users\Admin\khlskhs.exe" /r3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\khlskhs.exe"C:\Users\Admin\khlskhs.exe" /r4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\2334.bat" "3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2334.batFilesize
135B
MD5d68df8a31ba181db42b5dd40c8b3ce5c
SHA168e43aa995ea31afb318abbb545f84fc95dd8df4
SHA2564fd5f22567817411e13799be168e4335e057b5ea3446f49173631f60bf4a3663
SHA5125b562767fcd19608508077c30d1d37213a69a8c7fed8cae086d5ec1b755d7056d3fd7a3cb1497a214a366432804e3d74d30ac34b1da1ec2e784ebe5325fa692d
-
C:\Users\Admin\khlskhs.exeFilesize
189KB
MD5eeb7e6c7f4ab9c7830b11f7fd7fd2011
SHA1beb0384bd419447ab753de454e8d071923928e98
SHA256c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
SHA512ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
C:\Users\Admin\khlskhs.exeFilesize
189KB
MD5eeb7e6c7f4ab9c7830b11f7fd7fd2011
SHA1beb0384bd419447ab753de454e8d071923928e98
SHA256c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
SHA512ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
C:\Users\Admin\khlskhs.exeFilesize
189KB
MD5eeb7e6c7f4ab9c7830b11f7fd7fd2011
SHA1beb0384bd419447ab753de454e8d071923928e98
SHA256c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
SHA512ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
\Users\Admin\khlskhs.exeFilesize
189KB
MD5eeb7e6c7f4ab9c7830b11f7fd7fd2011
SHA1beb0384bd419447ab753de454e8d071923928e98
SHA256c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
SHA512ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
\Users\Admin\khlskhs.exeFilesize
189KB
MD5eeb7e6c7f4ab9c7830b11f7fd7fd2011
SHA1beb0384bd419447ab753de454e8d071923928e98
SHA256c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c
SHA512ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208
-
memory/364-100-0x0000000000000000-mapping.dmp
-
memory/468-90-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/468-78-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/468-71-0x0000000000000000-mapping.dmp
-
memory/520-87-0x0000000000406D21-mapping.dmp
-
memory/840-60-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/840-76-0x0000000000300000-0x0000000000335000-memory.dmpFilesize
212KB
-
memory/840-68-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/840-63-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/840-59-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/840-64-0x0000000000406D21-mapping.dmp
-
memory/840-73-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/840-54-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/840-55-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/840-67-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB
-
memory/840-62-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/840-57-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1200-65-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1852-96-0x00000000000C6D21-mapping.dmp
-
memory/1852-95-0x00000000000C0000-0x00000000000E6000-memory.dmpFilesize
152KB
-
memory/1852-102-0x00000000000C0000-0x00000000000E6000-memory.dmpFilesize
152KB
-
memory/1852-103-0x00000000000C0000-0x00000000000E6000-memory.dmpFilesize
152KB