cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6

General

Target

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
Size

404.2MB
MD5

fcb4b9dfe2f6ed4504410160001d03a7
SHA1

2b66273ea2797e5ba3e33582da6d0f91f5e7833c
SHA256

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6
SHA512

3373699f165aab7cccfb6062ac3c3a49d76fc7591f971a76ce4e6d3eb7e1f0fdfad2d71a7632bd5013a44d8b718ef510f3198c87572f58d828c5d68a613a9efa
SSDEEP

49152:At33d2m6BN4NPGonVbx5Y3Va5i/QWKxLBNZZcAt:iQozTG3Va5iYJxLB7ZcA

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe

pid process

1020 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

984 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe

pid process

1356 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1964 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1624 PING.EXE

pid	process
1020	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe

pid	process
984	cmd.exe

pid	process
1964	schtasks.exe

pid	process
1624	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exeJamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe

pid	process
1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1020	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
1020	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
1020	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
1020	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
1020	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.execmd.exe

description	pid	process	target process
PID 1356 wrote to memory of 1964	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	schtasks.exe
PID 1356 wrote to memory of 1964	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	schtasks.exe
PID 1356 wrote to memory of 1964	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	schtasks.exe
PID 1356 wrote to memory of 1964	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	schtasks.exe
PID 1356 wrote to memory of 1020	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
PID 1356 wrote to memory of 1020	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
PID 1356 wrote to memory of 1020	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
PID 1356 wrote to memory of 1020	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
PID 1356 wrote to memory of 984	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	cmd.exe
PID 1356 wrote to memory of 984	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	cmd.exe
PID 1356 wrote to memory of 984	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	cmd.exe
PID 1356 wrote to memory of 984	1356	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	cmd.exe
PID 984 wrote to memory of 812	984	cmd.exe	chcp.com
PID 984 wrote to memory of 812	984	cmd.exe	chcp.com
PID 984 wrote to memory of 812	984	cmd.exe	chcp.com
PID 984 wrote to memory of 812	984	cmd.exe	chcp.com
PID 984 wrote to memory of 1624	984	cmd.exe	PING.EXE
PID 984 wrote to memory of 1624	984	cmd.exe	PING.EXE
PID 984 wrote to memory of 1624	984	cmd.exe	PING.EXE
PID 984 wrote to memory of 1624	984	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
"C:\Users\Admin\AppData\Local\Temp\cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe"
2⤵
- Creates scheduled task(s)
PID:1964

C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
"C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1020

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:812

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
Filesize
1196.2MB

MD5
efe446187aac16d6c76b2846e582c292

SHA1
ddec01799220a5655bb81e5838803bbd8c4089c8

SHA256
faa36b8ed69b4d20208f710ec5fa6fb2b1d08b73a6d30b91dc968e2b69eaffdc

SHA512
e67184de71a323cf2d8aa0dee66ec1221b382eee5765105187d528b2021d0231d13622d1ee2a0f69ae0e264f817846aea01efec00ea6b06257377dd114cc5c6d

Download Submit
\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
Filesize
1196.2MB

MD5
efe446187aac16d6c76b2846e582c292

SHA1
ddec01799220a5655bb81e5838803bbd8c4089c8

SHA256
faa36b8ed69b4d20208f710ec5fa6fb2b1d08b73a6d30b91dc968e2b69eaffdc

SHA512
e67184de71a323cf2d8aa0dee66ec1221b382eee5765105187d528b2021d0231d13622d1ee2a0f69ae0e264f817846aea01efec00ea6b06257377dd114cc5c6d

Download Submit
memory/812-64-0x0000000000000000-mapping.dmp

Download
memory/984-62-0x0000000000000000-mapping.dmp

Download
memory/1020-59-0x0000000000000000-mapping.dmp

Download
memory/1020-65-0x00000000022F0000-0x0000000002450000-memory.dmp

Filesize
1.4MB

Download
memory/1020-66-0x000000000ACA0000-0x000000000ACFE000-memory.dmp

Filesize
376KB

Download
memory/1020-67-0x000000000ACA0000-0x000000000ACFE000-memory.dmp

Filesize
376KB

Download
memory/1020-69-0x00000000022F0000-0x0000000002450000-memory.dmp

Filesize
1.4MB

Download
memory/1356-56-0x0000000002430000-0x0000000002590000-memory.dmp

Filesize
1.4MB

Download
memory/1356-55-0x0000000002430000-0x0000000002590000-memory.dmp

Filesize
1.4MB

Download
memory/1356-63-0x0000000002430000-0x0000000002590000-memory.dmp

Filesize
1.4MB

Download
memory/1356-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/1624-68-0x0000000000000000-mapping.dmp

Download
memory/1964-57-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads