cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6

General

Target

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
Size

404.2MB
MD5

fcb4b9dfe2f6ed4504410160001d03a7
SHA1

2b66273ea2797e5ba3e33582da6d0f91f5e7833c
SHA256

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6
SHA512

3373699f165aab7cccfb6062ac3c3a49d76fc7591f971a76ce4e6d3eb7e1f0fdfad2d71a7632bd5013a44d8b718ef510f3198c87572f58d828c5d68a613a9efa
SSDEEP

49152:At33d2m6BN4NPGonVbx5Y3Va5i/QWKxLBNZZcAt:iQozTG3Va5iYJxLB7ZcA

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe

pid process

1604 Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1384 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe

pid process

1616 cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

912 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

396 PING.EXE

pid	process
1604	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe

pid	process
1384	cmd.exe

pid	process
912	schtasks.exe

pid	process
396	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exeJamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe

pid	process
1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
1604	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
1604	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
1604	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
1604	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
1604	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.execmd.exe

description	pid	process	target process
PID 1616 wrote to memory of 912	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	schtasks.exe
PID 1616 wrote to memory of 912	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	schtasks.exe
PID 1616 wrote to memory of 912	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	schtasks.exe
PID 1616 wrote to memory of 912	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	schtasks.exe
PID 1616 wrote to memory of 1604	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
PID 1616 wrote to memory of 1604	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
PID 1616 wrote to memory of 1604	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
PID 1616 wrote to memory of 1604	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
PID 1616 wrote to memory of 1384	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	cmd.exe
PID 1616 wrote to memory of 1384	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	cmd.exe
PID 1616 wrote to memory of 1384	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	cmd.exe
PID 1616 wrote to memory of 1384	1616	cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe	cmd.exe
PID 1384 wrote to memory of 1780	1384	cmd.exe	chcp.com
PID 1384 wrote to memory of 1780	1384	cmd.exe	chcp.com
PID 1384 wrote to memory of 1780	1384	cmd.exe	chcp.com
PID 1384 wrote to memory of 1780	1384	cmd.exe	chcp.com
PID 1384 wrote to memory of 396	1384	cmd.exe	PING.EXE
PID 1384 wrote to memory of 396	1384	cmd.exe	PING.EXE
PID 1384 wrote to memory of 396	1384	cmd.exe	PING.EXE
PID 1384 wrote to memory of 396	1384	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe
"C:\Users\Admin\AppData\Local\Temp\cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe"
2⤵
- Creates scheduled task(s)
PID:912

C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
"C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1604

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:1780

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
Filesize
1167.2MB

MD5
2284368eb54a79ee629221312a01406d

SHA1
7dfba81ce1ee21f6cb8cd0bd4f57a2363a92b363

SHA256
8368999366416ebef13313744bb84e36d574a5e09ffbd7de443fe0cba6ad1392

SHA512
6f37ed2d0e0ff4ada1a5afa14b2e3dab844b425d54a6b6527971d605df47c02074d0e27215bd79f50b69ea8c5ca0eaedede4556d25d550b0bac4d932aa9eacac

Download Submit
\Users\Admin\Pedadak moquihi kevevor ceg koxo mevologi\Jamokam quaqui woqueye yexoses mihoko foquaneh dajetifa hawohij darivif.exe
Filesize
1167.2MB

MD5
2284368eb54a79ee629221312a01406d

SHA1
7dfba81ce1ee21f6cb8cd0bd4f57a2363a92b363

SHA256
8368999366416ebef13313744bb84e36d574a5e09ffbd7de443fe0cba6ad1392

SHA512
6f37ed2d0e0ff4ada1a5afa14b2e3dab844b425d54a6b6527971d605df47c02074d0e27215bd79f50b69ea8c5ca0eaedede4556d25d550b0bac4d932aa9eacac

Download Submit
memory/396-64-0x0000000000000000-mapping.dmp

Download
memory/912-56-0x0000000000000000-mapping.dmp

Download
memory/1384-61-0x0000000000000000-mapping.dmp

Download
memory/1604-58-0x0000000000000000-mapping.dmp

Download
memory/1604-65-0x0000000000B10000-0x0000000000C70000-memory.dmp

Filesize
1.4MB

Download
memory/1604-66-0x0000000000380000-0x00000000003DE000-memory.dmp

Filesize
376KB

Download
memory/1604-67-0x0000000000B10000-0x0000000000C70000-memory.dmp

Filesize
1.4MB

Download
memory/1616-55-0x0000000000CA0000-0x0000000000E00000-memory.dmp

Filesize
1.4MB

Download
memory/1616-62-0x0000000000CA0000-0x0000000000E00000-memory.dmp

Filesize
1.4MB

Download
memory/1616-54-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/1780-63-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads