Analysis

  • max time kernel
    106s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2023 18:52

General

  • Target

    Unlocker1.9.2.exe

  • Size

    1.0MB

  • MD5

    1e02d6aa4a199448719113ae3926afb2

  • SHA1

    f1eff6451ced129c0e5c0a510955f234a01158a0

  • SHA256

    fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397

  • SHA512

    7d0f1416beb8c141ee992fe594111042309690c00741dff8f9f31b4652ed6a96b57532780e3169391440076d7ace63966fab526a076adcdc7f7ab389b4d0ff98

  • SSDEEP

    24576:eLMeYSiGTpTLDxxwqQcqOj5eyHox6ZGmAuXE7ZBlbT:+PbVvwqQpoLHontDrlbT

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Unlocker1.9.2.exe
    "C:\Users\Admin\AppData\Local\Temp\Unlocker1.9.2.exe"
    1⤵
    • Sets service image path in registry
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Users\Admin\AppData\Local\Temp\DeltaTB.exe
      "C:\Users\Admin\AppData\Local\Temp\DeltaTB.exe" /aflt=babsst /babTrack="affID=122471" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3548
      • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\Setup.exe" -xprm="cat=delta" -expg=none /aflt=babsst /babTrack="affID=122471" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3184
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\6AD637~1\IEHelper.dll,UpdateProtectedModeCookieCache URI|http://babylon.com
          4⤵
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Modifies Internet Explorer settings
          PID:5032
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Unlocker\UnlockerCOM.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4040
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files\Unlocker\UnlockerCOM.dll"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Modifies registry class
        PID:3772
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1800
  • C:\Program Files\Unlocker\Unlocker.exe
    "C:\Program Files\Unlocker\Unlocker.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4560

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Unlocker\Unlocker.exe

    Filesize

    122KB

    MD5

    0a77f732624155a215f5ca54df9b2930

    SHA1

    172bdf71343dd6544cfbe04abbc3dec4535f7d84

    SHA256

    a0b651038c4301f70e4aea506eb90edc584a5c4ca46880c7dc2ae5eafa6dc506

    SHA512

    6482c9fc3b5ff9d5798deb9965b4dfab9ba62b889e921011696f29dd96b813194a59f76a52a88fa4962317c6a43a21122c857e4ca80c6c4360c2cee544117352

  • C:\Program Files\Unlocker\Unlocker.exe

    Filesize

    122KB

    MD5

    0a77f732624155a215f5ca54df9b2930

    SHA1

    172bdf71343dd6544cfbe04abbc3dec4535f7d84

    SHA256

    a0b651038c4301f70e4aea506eb90edc584a5c4ca46880c7dc2ae5eafa6dc506

    SHA512

    6482c9fc3b5ff9d5798deb9965b4dfab9ba62b889e921011696f29dd96b813194a59f76a52a88fa4962317c6a43a21122c857e4ca80c6c4360c2cee544117352

  • C:\Program Files\Unlocker\UnlockerCOM.dll

    Filesize

    19KB

    MD5

    5fe324d6c1dc481136742ab5fb8f6672

    SHA1

    02f2d4476006cecd771de3cbe247e432950ae916

    SHA256

    0a66b19bb38385a8879633dce1272b8acf1b4b264c88e254345ec249335b41b1

    SHA512

    faa76477503923d1c14a12f00d7d416e5fbb485560ea02ed1e6ef6337f9ad88bc612af241ea61c8f9003253ccf5f66b2c7ce4a508bb2adc761c4f36ac345195d

  • C:\Program Files\Unlocker\UnlockerCOM.dll

    Filesize

    19KB

    MD5

    5fe324d6c1dc481136742ab5fb8f6672

    SHA1

    02f2d4476006cecd771de3cbe247e432950ae916

    SHA256

    0a66b19bb38385a8879633dce1272b8acf1b4b264c88e254345ec249335b41b1

    SHA512

    faa76477503923d1c14a12f00d7d416e5fbb485560ea02ed1e6ef6337f9ad88bc612af241ea61c8f9003253ccf5f66b2c7ce4a508bb2adc761c4f36ac345195d

  • C:\Program Files\Unlocker\UnlockerCOM.dll

    Filesize

    19KB

    MD5

    5fe324d6c1dc481136742ab5fb8f6672

    SHA1

    02f2d4476006cecd771de3cbe247e432950ae916

    SHA256

    0a66b19bb38385a8879633dce1272b8acf1b4b264c88e254345ec249335b41b1

    SHA512

    faa76477503923d1c14a12f00d7d416e5fbb485560ea02ed1e6ef6337f9ad88bc612af241ea61c8f9003253ccf5f66b2c7ce4a508bb2adc761c4f36ac345195d

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\Babylon.dat

    Filesize

    12KB

    MD5

    825e5733974586a0a1229a53361ed13e

    SHA1

    9ec5b8944c6727fda6fdc3c18856884554cf6b31

    SHA256

    0a90b96eaf5d92d33b36f73b36b7f9ce3971e5f294da51ed04da3fb43dd71a96

    SHA512

    ff039e86873a1014b1f8577aec9b4230126b41cc204a6911cd372d224b8c07996d4bb2728a06482c5e98fb21f2d525395491f29d428cdd5796a26e372af5ad4e

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\IEHelper.dll

    Filesize

    6KB

    MD5

    a21de5067618d4f2df261416315ed120

    SHA1

    7759a3318de2abc3755ebb7f50322c6d586b5286

    SHA256

    6d13d2967a37ba76f840cd45dba565c5d64938a99d886243f01713cd018e53ca

    SHA512

    6b5c40d09a9548fde90c1b1127a36e813525bea6ff80d5fb0911ddef67954b209df44cbf4714cd00c4e2e4da90cfc4967db7174c28f751f7c5b881fa18cc938a

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\Setup.exe

    Filesize

    1.8MB

    MD5

    26f6d1b6756a83de9755a05f7c030d75

    SHA1

    935f58155f74b051f9123b6022b7d358b52b146f

    SHA256

    2acab7c986bbf80578c3bd998dd2d853257719ceb74c9d30bb4ea28952403d5b

    SHA512

    af9603572bddb6244a7ab0484cb3ac9ed7c91b1cea3e3f8c8886478930dbc102925b45ed094eaa2801755644e3bb4a4c0685a423f937f4b02af16feec56e4f6f

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\Setup.exe

    Filesize

    1.8MB

    MD5

    26f6d1b6756a83de9755a05f7c030d75

    SHA1

    935f58155f74b051f9123b6022b7d358b52b146f

    SHA256

    2acab7c986bbf80578c3bd998dd2d853257719ceb74c9d30bb4ea28952403d5b

    SHA512

    af9603572bddb6244a7ab0484cb3ac9ed7c91b1cea3e3f8c8886478930dbc102925b45ed094eaa2801755644e3bb4a4c0685a423f937f4b02af16feec56e4f6f

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\SetupStrings.dat

    Filesize

    89KB

    MD5

    407846797c5ba247abeb5fa7c0c0ba05

    SHA1

    44386455eed8e74d75e95e9e81e96a19f0b27884

    SHA256

    0147b5b11b935310752666fcf1e6afc922b76ff03d01a0d1ee2babeac10ca1e3

    SHA512

    7399a9228f971698db7362aad28d3f9694c0bf453d4529e48bc7869af0960452cfe1a5f0a5754e7d567d81b5aa1e35be05a9e36ec745e5470d20fd44a61d20af

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\bab033.tbinst.dat

    Filesize

    205B

    MD5

    90713ab7a74884cd36a5fb4cfcdece8a

    SHA1

    7bb56d08fd69a98e543b923bd0a9156f92a9c473

    SHA256

    bc40813f6d07dbc1a4d4c74363460d1ad6ee76275729de4c4f10ec40d8cc46eb

    SHA512

    639d68135fb54264f2e21081d6ca9ffe73a94035982f4a2d7133d6d402cdd3ef4a695eeb61ad173dc6d1b8167d1f5df2be61a972c96f07ac357ecec887a0d191

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\bab091.norecovericon.dat

    Filesize

    174B

    MD5

    4f6e1fdbef102cdbd379fdac550b9f48

    SHA1

    5da6ee5b88a4040c80e5269e0cd2b0880b20659c

    SHA256

    e58ea352c050e6353fb5b4fa32a97800298c1603489d3b47794509af6c89ec4c

    SHA512

    54efc9bde44f332932a97396e59eca5b6ea1ac72f929ccffa1bdab96dc3ae8d61e126adbd26d12d0bc83141cee03b24ad2bada411230c4708b7a9ae9c60aecbe

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\bab148.spreg.dat

    Filesize

    249B

    MD5

    a4af0a0c254b38f2f9eecbf0e00b08fe

    SHA1

    ef730bce77699730dda378dc444b997ce7ceea7a

    SHA256

    810e0e32d54b9e1557da7ccf1ca9f6354814e90dadc6b4af5e1cbdf87fac925a

    SHA512

    b74596e55e75413303559c135db393a04d6fd6cbab147a51ac2f46435f52b92b82868de4e67917a7b388d82c672fa36b525b88e2eefe7ec40695f028395dcd84

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\bab187.wl.dat

    Filesize

    234B

    MD5

    6358860cd0c336c1f91f86be701d77c4

    SHA1

    5dd38b818bf0860b4c5144ba670a759d4345e4ec

    SHA256

    2ed42e3c958eb21352bae4b00db2fa5be94149abc64eec93e5258b9c4a715457

    SHA512

    7df3b3e1487d3a65000b6208969f1e695815133c052f369beb36877fe5c6f64d979aefd030a193b04a5e46fb0d97a3cc06837aa381efe6bc24a0c084c768dac1

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\bab307.sp_pop0.dat

    Filesize

    178B

    MD5

    0b7be9c4b72c2c5166bfd61ca5ebbfed

    SHA1

    aea0aa4e8226c1b4efce92e909da773744baa6d4

    SHA256

    673bf972d308bc6108360575608cf72f393413f2d3993489b06da4a6efc749bd

    SHA512

    4dcd7ea01b05550acb00b71e7e9fdd52a04fe1cc574655030dcae94b87dad86bfb7973adf9185de03bcacb100fff758b1a2f928fcb951e2b31e320860a2226d8

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\bab456.TB_OldWay.dat

    Filesize

    174B

    MD5

    7e72d256e34635d351092955d1f8516b

    SHA1

    7f240f8f4bd61ae59247d84d0ec85f5bc8729f36

    SHA256

    39eb1667a67149b5d930e5408896027e3c3fc06282735e61cb8d85f5b38f587c

    SHA512

    621eb4bf2864db2fa0f861c233ced790124e9060c081948beb7117f8c058a36ecca23ee05ce2d6d42af15533c050f648d276589682d91dfe699ebe871cc9ae8c

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\sqlite3.dll

    Filesize

    508KB

    MD5

    0f66e8e2340569fb17e774dac2010e31

    SHA1

    406bb6854e7384ff77c0b847bf2f24f3315874a3

    SHA256

    de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f

    SHA512

    39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05

  • C:\Users\Admin\AppData\Local\Temp\6AD63750-BAB0-7891-81B6-2C315ADA4156\sqlite3.dll

    Filesize

    508KB

    MD5

    0f66e8e2340569fb17e774dac2010e31

    SHA1

    406bb6854e7384ff77c0b847bf2f24f3315874a3

    SHA256

    de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f

    SHA512

    39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05

  • C:\Users\Admin\AppData\Local\Temp\6AD637~1\IEHelper.dll

    Filesize

    6KB

    MD5

    a21de5067618d4f2df261416315ed120

    SHA1

    7759a3318de2abc3755ebb7f50322c6d586b5286

    SHA256

    6d13d2967a37ba76f840cd45dba565c5d64938a99d886243f01713cd018e53ca

    SHA512

    6b5c40d09a9548fde90c1b1127a36e813525bea6ff80d5fb0911ddef67954b209df44cbf4714cd00c4e2e4da90cfc4967db7174c28f751f7c5b881fa18cc938a

  • C:\Users\Admin\AppData\Local\Temp\DeltaTB.exe

    Filesize

    767KB

    MD5

    eb2764885565b6c01cb32e5f51f213b3

    SHA1

    cc41cadbbd6ba6ed0bfdd17798b4c9f94d7955e0

    SHA256

    d7146999ff94b3ae092f3213ddf0217615f1d38798393b66778d11aae2b68eaf

    SHA512

    ac88795b2e8260ace9eb57d2a3fdc4aadb18e2cb0afd780459f51d25f83b34f7033425dc712655e423eba4e011fd2776f53463042f2c2d9dd427554c04cc840e

  • C:\Users\Admin\AppData\Local\Temp\DeltaTB.exe

    Filesize

    767KB

    MD5

    eb2764885565b6c01cb32e5f51f213b3

    SHA1

    cc41cadbbd6ba6ed0bfdd17798b4c9f94d7955e0

    SHA256

    d7146999ff94b3ae092f3213ddf0217615f1d38798393b66778d11aae2b68eaf

    SHA512

    ac88795b2e8260ace9eb57d2a3fdc4aadb18e2cb0afd780459f51d25f83b34f7033425dc712655e423eba4e011fd2776f53463042f2c2d9dd427554c04cc840e

  • C:\Users\Admin\AppData\Local\Temp\nsa6EDD.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • C:\Users\Admin\AppData\Local\Temp\nsa6EDD.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • C:\Users\Admin\AppData\Local\Temp\nsa6EDD.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    9384f4007c492d4fa040924f31c00166

    SHA1

    aba37faef30d7c445584c688a0b5638f5db31c7b

    SHA256

    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    SHA512

    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

  • C:\Users\Admin\AppData\Local\Temp\nsa6EDD.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    9384f4007c492d4fa040924f31c00166

    SHA1

    aba37faef30d7c445584c688a0b5638f5db31c7b

    SHA256

    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    SHA512

    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

  • C:\Users\Admin\AppData\Local\Temp\nsa6EDD.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • memory/2136-137-0x0000000002391000-0x0000000002393000-memory.dmp

    Filesize

    8KB

  • memory/3184-141-0x0000000000000000-mapping.dmp

  • memory/3548-138-0x0000000000000000-mapping.dmp

  • memory/3772-147-0x0000000000000000-mapping.dmp

  • memory/4040-142-0x0000000000000000-mapping.dmp

  • memory/5032-157-0x0000000000000000-mapping.dmp