Analysis
-
max time kernel
311s -
max time network
332s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 04:50
Static task
static1
Behavioral task
behavioral1
Sample
e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe
Resource
win7-20221111-en
General
-
Target
e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe
-
Size
7.1MB
-
MD5
51dae8d6208cc255aea7ad0eaba77014
-
SHA1
dd949ae42f7bc491ac29d9d68b8d12379270bb1a
-
SHA256
e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b
-
SHA512
c3ab44e3e69e8baee8f215ab2297cab20d2fb9a56e375ae86e8e1102f7d43f683cee64bcd3bfcf59d60742bab80b371de3b18fd5519414787d1cf4eb2e992ed5
-
SSDEEP
196608:F7nmjqCE8cpmmTVPuF2O8ET7pbO0yA7GO:F7nYRE8cQmTVP2vnl7L
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exepid process 2024 Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe -
Loads dropped DLL 1 IoCs
Processes:
e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exepid process 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exeBovawata quaj kokeley gacebe meda loy bogodime vexevi.exepid process 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe 2024 Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe 2024 Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exedescription pid process target process PID 956 wrote to memory of 1384 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe schtasks.exe PID 956 wrote to memory of 1384 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe schtasks.exe PID 956 wrote to memory of 1384 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe schtasks.exe PID 956 wrote to memory of 1384 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe schtasks.exe PID 956 wrote to memory of 2024 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe PID 956 wrote to memory of 2024 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe PID 956 wrote to memory of 2024 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe PID 956 wrote to memory of 2024 956 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe"C:\Users\Admin\AppData\Local\Temp\e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Bel migomota yexiquiv tisax-newanax fab cegom\Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Bel migomota yexiquiv tisax-newanax fab cegom\Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe"C:\Users\Admin\Bel migomota yexiquiv tisax-newanax fab cegom\Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Bel migomota yexiquiv tisax-newanax fab cegom\Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exeFilesize
25.2MB
MD56c8c942cf6be78cc041f83f62405f73d
SHA1396fbd28af128ed749462ec78ea21068ba2de193
SHA256faabd69d4708d2b384cf83aeeb90584ac31b8eb2c4a214a1f3d7169c26368b0e
SHA512b05d01df8a4f6497b7e13e9ee9925f16814733cecac57bfaad2c1219ae83be1363a105af272c8e46c100da1c49f045952ec56786d2e048f94c0853836aeb8925
-
C:\Users\Admin\Bel migomota yexiquiv tisax-newanax fab cegom\Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exeFilesize
25.6MB
MD5827f619f6fe6a663b2005840f6369670
SHA136561f7a4b1d394518a5307a50b74d137adc2282
SHA25655d7ccfc3a19aedca0ef4dfb58af982e2aca5e919177dafc410c77acc4e32b67
SHA51296de33d68cda0f6bcc114b768aa9b40a3830a1e58d8430d480d62424a644ba4c342c37dc15bc0e0fbc294e8407c191cc068a162e3fd77cea2d53b0ec861673fa
-
\Users\Admin\Bel migomota yexiquiv tisax-newanax fab cegom\Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exeFilesize
23.9MB
MD54256cde7a9eab090e1c74a1b6631ce4d
SHA1d3076ec156668cdc448c9e8beaaad035169be242
SHA25673f85a1c6bf77e50b5ca6307de0046ffc1d9583bec87924637a344f2750fd770
SHA512f5fc3cc3f6e6615f3696541a65bf7a5e46042f272c64a96f6b9f3be2f16e905ace6fb10e43e4467d37ae9d624c43ac3e6d202a29160eef33f02bea2606ac2750
-
memory/956-55-0x0000000000400000-0x0000000000D33000-memory.dmpFilesize
9.2MB
-
memory/956-56-0x0000000002800000-0x00000000028F4000-memory.dmpFilesize
976KB
-
memory/956-57-0x00000000753D1000-0x00000000753D3000-memory.dmpFilesize
8KB
-
memory/956-58-0x0000000000400000-0x0000000000D33000-memory.dmpFilesize
9.2MB
-
memory/956-59-0x0000000002800000-0x00000000028F4000-memory.dmpFilesize
976KB
-
memory/1384-60-0x0000000000000000-mapping.dmp
-
memory/2024-62-0x0000000000000000-mapping.dmp
-
memory/2024-65-0x0000000000400000-0x0000000000D33000-memory.dmpFilesize
9.2MB