Analysis
-
max time kernel
41s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 17:33
Static task
static1
Behavioral task
behavioral1
Sample
c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe
Resource
win10v2004-20221111-en
General
-
Target
c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe
-
Size
322KB
-
MD5
ec9c131b92b4c37bae39adb79b167e0e
-
SHA1
066430a555f2afe51ee39db3b7e2e03791105e40
-
SHA256
c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab
-
SHA512
920b6e44ac032c13e2bfd861440c93e04c6c67960191d89e385d6c596c916e148f0555422aeb49c3aa6b309f5191c8d2cfd792c3d50a0e01b5cc5a84257cc5a7
-
SSDEEP
6144:217/qs70CkEE/xzP6m/HDnP3Bw3gSfYlYaaRIDylnxtIYmDh7HgARCGuD:C7/qs7LUOmbPxww1vu1mrgdG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
qyeobbula.exepid process 840 qyeobbula.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1712 cmd.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exeqyeobbula.exepid process 1712 cmd.exe 1712 cmd.exe 840 qyeobbula.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 320 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 320 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.execmd.exedescription pid process target process PID 1948 wrote to memory of 1712 1948 c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe cmd.exe PID 1948 wrote to memory of 1712 1948 c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe cmd.exe PID 1948 wrote to memory of 1712 1948 c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe cmd.exe PID 1948 wrote to memory of 1712 1948 c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe cmd.exe PID 1712 wrote to memory of 320 1712 cmd.exe taskkill.exe PID 1712 wrote to memory of 320 1712 cmd.exe taskkill.exe PID 1712 wrote to memory of 320 1712 cmd.exe taskkill.exe PID 1712 wrote to memory of 320 1712 cmd.exe taskkill.exe PID 1712 wrote to memory of 1824 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 1824 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 1824 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 1824 1712 cmd.exe PING.EXE PID 1712 wrote to memory of 840 1712 cmd.exe qyeobbula.exe PID 1712 wrote to memory of 840 1712 cmd.exe qyeobbula.exe PID 1712 wrote to memory of 840 1712 cmd.exe qyeobbula.exe PID 1712 wrote to memory of 840 1712 cmd.exe qyeobbula.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe"C:\Users\Admin\AppData\Local\Temp\c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1948 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab.exe" & start C:\Users\Admin\AppData\Local\QYEOBB~1.EXE -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 19483⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\qyeobbula.exeC:\Users\Admin\AppData\Local\QYEOBB~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\qyeobbula.exeFilesize
322KB
MD5ec9c131b92b4c37bae39adb79b167e0e
SHA1066430a555f2afe51ee39db3b7e2e03791105e40
SHA256c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab
SHA512920b6e44ac032c13e2bfd861440c93e04c6c67960191d89e385d6c596c916e148f0555422aeb49c3aa6b309f5191c8d2cfd792c3d50a0e01b5cc5a84257cc5a7
-
C:\Users\Admin\AppData\Local\qyeobbula.exeFilesize
322KB
MD5ec9c131b92b4c37bae39adb79b167e0e
SHA1066430a555f2afe51ee39db3b7e2e03791105e40
SHA256c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab
SHA512920b6e44ac032c13e2bfd861440c93e04c6c67960191d89e385d6c596c916e148f0555422aeb49c3aa6b309f5191c8d2cfd792c3d50a0e01b5cc5a84257cc5a7
-
\Users\Admin\AppData\Local\qyeobbula.exeFilesize
322KB
MD5ec9c131b92b4c37bae39adb79b167e0e
SHA1066430a555f2afe51ee39db3b7e2e03791105e40
SHA256c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab
SHA512920b6e44ac032c13e2bfd861440c93e04c6c67960191d89e385d6c596c916e148f0555422aeb49c3aa6b309f5191c8d2cfd792c3d50a0e01b5cc5a84257cc5a7
-
\Users\Admin\AppData\Local\qyeobbula.exeFilesize
322KB
MD5ec9c131b92b4c37bae39adb79b167e0e
SHA1066430a555f2afe51ee39db3b7e2e03791105e40
SHA256c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab
SHA512920b6e44ac032c13e2bfd861440c93e04c6c67960191d89e385d6c596c916e148f0555422aeb49c3aa6b309f5191c8d2cfd792c3d50a0e01b5cc5a84257cc5a7
-
\Users\Admin\AppData\Local\qyeobbula.exeFilesize
322KB
MD5ec9c131b92b4c37bae39adb79b167e0e
SHA1066430a555f2afe51ee39db3b7e2e03791105e40
SHA256c5639ff410da6b9713d95f5bed56e763f3e5c07c06aa0e663d1336c13a18bcab
SHA512920b6e44ac032c13e2bfd861440c93e04c6c67960191d89e385d6c596c916e148f0555422aeb49c3aa6b309f5191c8d2cfd792c3d50a0e01b5cc5a84257cc5a7
-
memory/320-57-0x0000000000000000-mapping.dmp
-
memory/840-62-0x0000000000000000-mapping.dmp
-
memory/840-66-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/840-67-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/1712-55-0x0000000000000000-mapping.dmp
-
memory/1824-58-0x0000000000000000-mapping.dmp
-
memory/1948-56-0x0000000001000000-0x00000000010A5000-memory.dmpFilesize
660KB
-
memory/1948-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB