Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 18:11
Behavioral task
behavioral1
Sample
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe
-
Size
360KB
-
MD5
8c150a49cf075c56a977d5a5aa858b14
-
SHA1
a755d1e193c3d81eaa4a581a33f8d49cc7d10507
-
SHA256
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954
-
SHA512
9af5073d5e869009564b2d7c540c8918deeb4768d9f90ddd647c90c4a40a6583d8f3e671bb5330cf29b525683025b489af4b359ab68960092936db1ee3f0baab
-
SSDEEP
6144:IT9P02oCOcImaKGD0oEOGSerEhgVIXFMv:0PlosIHooDerLIXi
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exec15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exeearconmini.exeearconmini.exepid process 4916 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe 4916 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe 4872 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe 4872 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe 2488 earconmini.exe 2488 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe 1396 earconmini.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exepid process 4872 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exeearconmini.exedescription pid process target process PID 4916 wrote to memory of 4872 4916 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe PID 4916 wrote to memory of 4872 4916 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe PID 4916 wrote to memory of 4872 4916 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe PID 2488 wrote to memory of 1396 2488 earconmini.exe earconmini.exe PID 2488 wrote to memory of 1396 2488 earconmini.exe earconmini.exe PID 2488 wrote to memory of 1396 2488 earconmini.exe earconmini.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe"C:\Users\Admin\AppData\Local\Temp\c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe"C:\Users\Admin\AppData\Local\Temp\c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\earconmini.exe"C:\Windows\SysWOW64\earconmini.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\earconmini.exe"C:\Windows\SysWOW64\earconmini.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1396-137-0x0000000000000000-mapping.dmp
-
memory/1396-139-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/1396-140-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/2488-136-0x00000000005D0000-0x00000000005E5000-memory.dmpFilesize
84KB
-
memory/4872-133-0x0000000000000000-mapping.dmp
-
memory/4872-135-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/4872-138-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4916-132-0x0000000002190000-0x00000000021A5000-memory.dmpFilesize
84KB
-
memory/4916-134-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB