Analysis
-
max time kernel
198s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 07:29
Behavioral task
behavioral1
Sample
c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe
Resource
win7-20221111-en
General
-
Target
c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe
-
Size
120KB
-
MD5
016030e3fd20263c5e903d8713316c7a
-
SHA1
7b1c61052a9046ee1639b61b89e012021aa63bcc
-
SHA256
c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e
-
SHA512
113cfcaeb8bb5b7bc35047341a345fc50086081cb02e7ec5cd3f8327bbf3cd9fbcf744bd849bbf6804ada30683c8e7605cd68d8e976763414f09cf43619e473e
-
SSDEEP
3072:Ig+3fh/PHrgNUqOBx4J2vNbGfvGnd3gW5ZM4/uBnz:h+3fRb9NdndPZMTF
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\nwefylss\\vdsrjlcj.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
niqmonepsbaymkfn.exepid process 1612 niqmonepsbaymkfn.exe -
Processes:
resource yara_rule behavioral1/memory/1736-73-0x0000000000400000-0x000000000043957C-memory.dmp upx \Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exe upx \Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exe upx \Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exe upx \Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exe upx C:\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exe upx C:\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exe upx behavioral1/memory/1612-83-0x0000000000400000-0x000000000043957C-memory.dmp upx behavioral1/memory/1612-84-0x0000000000400000-0x000000000043957C-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vdsrjlcj.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vdsrjlcj.exe svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exepid process 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\VdsRjlcj = "C:\\Users\\Admin\\AppData\\Local\\nwefylss\\vdsrjlcj.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
svchost.exepid process 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe 1876 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 460 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exesvchost.exesvchost.exeniqmonepsbaymkfn.exedescription pid process Token: SeSecurityPrivilege 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe Token: SeDebugPrivilege 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe Token: SeSecurityPrivilege 2040 svchost.exe Token: SeSecurityPrivilege 1876 svchost.exe Token: SeDebugPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeSecurityPrivilege 1612 niqmonepsbaymkfn.exe Token: SeLoadDriverPrivilege 1612 niqmonepsbaymkfn.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe Token: SeBackupPrivilege 1876 svchost.exe Token: SeRestorePrivilege 1876 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exedescription pid process target process PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 2040 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1876 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe svchost.exe PID 1736 wrote to memory of 1612 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe niqmonepsbaymkfn.exe PID 1736 wrote to memory of 1612 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe niqmonepsbaymkfn.exe PID 1736 wrote to memory of 1612 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe niqmonepsbaymkfn.exe PID 1736 wrote to memory of 1612 1736 c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe niqmonepsbaymkfn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe"C:\Users\Admin\AppData\Local\Temp\c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exe"C:\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exeFilesize
120KB
MD5016030e3fd20263c5e903d8713316c7a
SHA17b1c61052a9046ee1639b61b89e012021aa63bcc
SHA256c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e
SHA512113cfcaeb8bb5b7bc35047341a345fc50086081cb02e7ec5cd3f8327bbf3cd9fbcf744bd849bbf6804ada30683c8e7605cd68d8e976763414f09cf43619e473e
-
C:\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exeFilesize
120KB
MD5016030e3fd20263c5e903d8713316c7a
SHA17b1c61052a9046ee1639b61b89e012021aa63bcc
SHA256c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e
SHA512113cfcaeb8bb5b7bc35047341a345fc50086081cb02e7ec5cd3f8327bbf3cd9fbcf744bd849bbf6804ada30683c8e7605cd68d8e976763414f09cf43619e473e
-
\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exeFilesize
120KB
MD5016030e3fd20263c5e903d8713316c7a
SHA17b1c61052a9046ee1639b61b89e012021aa63bcc
SHA256c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e
SHA512113cfcaeb8bb5b7bc35047341a345fc50086081cb02e7ec5cd3f8327bbf3cd9fbcf744bd849bbf6804ada30683c8e7605cd68d8e976763414f09cf43619e473e
-
\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exeFilesize
120KB
MD5016030e3fd20263c5e903d8713316c7a
SHA17b1c61052a9046ee1639b61b89e012021aa63bcc
SHA256c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e
SHA512113cfcaeb8bb5b7bc35047341a345fc50086081cb02e7ec5cd3f8327bbf3cd9fbcf744bd849bbf6804ada30683c8e7605cd68d8e976763414f09cf43619e473e
-
\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exeFilesize
120KB
MD5016030e3fd20263c5e903d8713316c7a
SHA17b1c61052a9046ee1639b61b89e012021aa63bcc
SHA256c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e
SHA512113cfcaeb8bb5b7bc35047341a345fc50086081cb02e7ec5cd3f8327bbf3cd9fbcf744bd849bbf6804ada30683c8e7605cd68d8e976763414f09cf43619e473e
-
\Users\Admin\AppData\Local\Temp\niqmonepsbaymkfn.exeFilesize
120KB
MD5016030e3fd20263c5e903d8713316c7a
SHA17b1c61052a9046ee1639b61b89e012021aa63bcc
SHA256c59591667e3592188badb37d5b494cf93518e104219cbe91c74c9753ab74ea8e
SHA512113cfcaeb8bb5b7bc35047341a345fc50086081cb02e7ec5cd3f8327bbf3cd9fbcf744bd849bbf6804ada30683c8e7605cd68d8e976763414f09cf43619e473e
-
memory/1612-84-0x0000000000400000-0x000000000043957C-memory.dmpFilesize
229KB
-
memory/1612-83-0x0000000000400000-0x000000000043957C-memory.dmpFilesize
229KB
-
memory/1612-79-0x0000000000000000-mapping.dmp
-
memory/1736-78-0x00000000027A0000-0x00000000027DA000-memory.dmpFilesize
232KB
-
memory/1736-73-0x0000000000400000-0x000000000043957C-memory.dmpFilesize
229KB
-
memory/1736-54-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB
-
memory/1876-69-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/1876-67-0x0000000000000000-mapping.dmp
-
memory/1876-65-0x0000000020010000-0x0000000020023000-memory.dmpFilesize
76KB
-
memory/2040-59-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2040-58-0x0000000000000000-mapping.dmp
-
memory/2040-56-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB