99cb9ea998d774a077d760f6a767660a520bc882a73195b3cd0282c2e967fb13

General

Target
file.exe
Size 1.3MB
Sample221207-asdqeshf39
SHA256 99cb9ea998d774a077d760f6a767660a520bc882a73195b3cd0282c2e967fb13
MD5 49d3d360aa4d5801e3e6cf63d799c793
SHA1 520f5870394c9976db688f77bc651ff0a3935691
SHA512 55eb643cc689ae380570d104d0c504c97af75fc78c1ecf5f7258466e7e2a2d5797c6790821452075bd84843863f3c84b65cd29ece138466b00962ef3802f538b
SSDEEP 24576:pj4Pq3FyJga5jGIwtwS7TSNqAzjuY4+1ziRN+FtxA8Xc009GtfzZfCev5mF62X+E:pjsZJj5jG9WoTy72YlziRaK0+Gt1
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1536	Kihoniv jakaveh xahalexe.exe

Deletes itself 1 IoCs

pid	Process
1796	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1584	file.exe
1584	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2036	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1364	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1584	file.exe
1584	file.exe
1584	file.exe
1584	file.exe
1584	file.exe
1536	Kihoniv jakaveh xahalexe.exe
1536	Kihoniv jakaveh xahalexe.exe
1536	Kihoniv jakaveh xahalexe.exe
1536	Kihoniv jakaveh xahalexe.exe
1536	Kihoniv jakaveh xahalexe.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2036	1584	file.exe	28
PID 1584 wrote to memory of 2036	1584	file.exe	28
PID 1584 wrote to memory of 2036	1584	file.exe	28
PID 1584 wrote to memory of 2036	1584	file.exe	28
PID 1584 wrote to memory of 1536	1584	file.exe	30
PID 1584 wrote to memory of 1536	1584	file.exe	30
PID 1584 wrote to memory of 1536	1584	file.exe	30
PID 1584 wrote to memory of 1536	1584	file.exe	30
PID 1584 wrote to memory of 1796	1584	file.exe	31
PID 1584 wrote to memory of 1796	1584	file.exe	31
PID 1584 wrote to memory of 1796	1584	file.exe	31
PID 1584 wrote to memory of 1796	1584	file.exe	31
PID 1796 wrote to memory of 1516	1796	cmd.exe	33
PID 1796 wrote to memory of 1516	1796	cmd.exe	33
PID 1796 wrote to memory of 1516	1796	cmd.exe	33
PID 1796 wrote to memory of 1516	1796	cmd.exe	33
PID 1796 wrote to memory of 1364	1796	cmd.exe	34
PID 1796 wrote to memory of 1364	1796	cmd.exe	34
PID 1796 wrote to memory of 1364	1796	cmd.exe	34
PID 1796 wrote to memory of 1364	1796	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\miqu laq\Kihoniv jakaveh xahalexe.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2036
- C:\Users\Admin\miqu laq\Kihoniv jakaveh xahalexe.exe
  "C:\Users\Admin\miqu laq\Kihoniv jakaveh xahalexe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Kihoniv jakaveh xahalexe.exe

Path C:\Users\Admin\miqu laq\Kihoniv jakaveh xahalexe.exe
Size 60.3MB
SHA256 d683d3ab82bee5e6098a25a174d671d2bbc3e78eed466265e3a4a49ff0a95904
MD5 55afb3f84b7723a45cddb94d9ad12bca
SHA1 2708918669f0ad22274ae832ecabb9ae8b39f2d2
SHA512 15be9ec6e24bbd6ecb36d7de0ab18300797b1d6c6cec8c9c66cfa5149ff18303864c2a65f662cde655b4a525103e19b8743b9c406311b9c18c0b946f569928b5
SSDEEP 24576:pj4Pq3FyJga5jGIwtwS7TSNqAzjuY4+1ziRN+FtxA8Xc009GtfzZfCev5mF62X+E:pjsZJj5jG9WoTy72YlziRaK0+Gt1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kihoniv jakaveh xahalexe.exe

Path \Users\Admin\miqu laq\Kihoniv jakaveh xahalexe.exe
Size 62.9MB
SHA256 2aa7af8d7adbd786a88c7587279cde020e663e3ce925104e0d04277e8a93c391
MD5 426e782952795a675de737925e114317
SHA1 6caaafd0a0f44d2c6f7dd29c3b3ac921083ce2f9
SHA512 a1ca07ce9bd28fdbebec100c11a3c8e58932cd3d5793ed488b55e49c396d4dd05454d0e55e40158211ec4cc4dabdaeb13f58b6c3e0db9ba46e618a0db834db7d
SSDEEP 24576:pj4Pq3FyJga5jGIwtwS7TSNqAzjuY4+1ziRN+FtxA8Xc009GtfzZfCev5mF62X+E:pjsZJj5jG9WoTy72YlziRaK0+Gt1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kihoniv jakaveh xahalexe.exe

Path \Users\Admin\miqu laq\Kihoniv jakaveh xahalexe.exe
Size 60.8MB
SHA256 c8fbc1c59b7469f118de65dbfbc22b777c17058a895baf676ddb2f6331b9d90a
MD5 f8532576e8f78d1cd0c3e26333642172
SHA1 397a5acb66ec9287392336dffbb838ba8dd5c483
SHA512 17619e5db2b0e40bac6f33a44791fbfde8cd6daf49b62f31fd8bdb3ef973eda7608d88e3e62f900a8e9a1baa734fe199fba7236a212b531b8c55b578da40b486
SSDEEP 24576:pj4Pq3FyJga5jGIwtwS7TSNqAzjuY4+1ziRN+FtxA8Xc009GtfzZfCev5mF62X+E:pjsZJj5jG9WoTy72YlziRaK0+Gt1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1536-67-0x00000000009F0000-0x0000000000AF5000-memory.dmp

Download

memory/1584-63-0x0000000002810000-0x0000000002915000-memory.dmp

Download

memory/1584-54-0x0000000002810000-0x0000000002915000-memory.dmp

Download

memory/1584-56-0x0000000002810000-0x0000000002915000-memory.dmp

Download

memory/1584-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads