Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 05:12
Static task
static1
Behavioral task
behavioral1
Sample
b85bcfc355d32617c12a2e71d4f80880.exe
Resource
win7-20220812-en
General
-
Target
b85bcfc355d32617c12a2e71d4f80880.exe
-
Size
271KB
-
MD5
b85bcfc355d32617c12a2e71d4f80880
-
SHA1
8f5e2fcc9006bdbdcab9b6e15893b781fb893775
-
SHA256
b9f158fac329391c893814424e77c4f9fc0460026b93327d8cf35598a561a1de
-
SHA512
90874f7c64abd954ec34b4152dee1562cb55af65916e854dcf9c52f4be0270ff71c3fe57f0466f7dc18ce49c5cface4b5818df355a847bba5a4c982721b56bd5
-
SSDEEP
6144:QBn1vvXZCzNhTIyD2bE8Nf7B0AxHklinnqPazURP3gawRwcV:gv+m/NDB0AxHklinnqPai3gdScV
Malware Config
Extracted
formbook
f4ca
omFHB5ajfJi1UEIEV9XcoRw=
UBjJkmQPyprdhcFF/bdCWQ==
evGKkBUj1je+otcfpw==
KgvGVeOATSt3nug0BIOm2JvOQycB
Lv6o3K0r9aSjI0lr9fg1txw=
LH1jJb/HieQpsEdqWCQTvX2PmsDVIeg=
99dte0XauJfk6Xv+uQxJFgA1gMktBA==
21FkkGB9gMniDQw2ffu6
r4lKBM/q6TZwVZfS
F+14qHeVWi56KdQ=
BgWXRsVoICMvvQ==
I+EozFl0Uy56KdQ=
xoXCgEllKEbWfjFCCLo=
qo9G1lXvvGt5GkxrLQWw
ORNlYic0PJ2ip4geEFSv
Yj+GFpvFxy0uVYx1fLI/XQ==
XL+veIKPjOTe4fjvFs+n
D2JKVAfuakXCAyoEvw==
voWJU81tH56wvt/vImbCcgVd
dVEcwFrmb8bZ4vXvFs+n
CMlcaOUF6cB+8Bnm2Kc=
NpYV3moXNE+ZQ4f9nVGCSA==
/GRkjGd1acLHyeLvImbCcgVd
R52MlF+Ag+LtFr1QKa7Zf/5a
kVD/mSO1YK75pA==
5q3IANfo/JHiDww2ffu6
4i8RFOH2ACRdhzja
VLWOSRe00XX6sNsijPzqiiWfFgf1J+g=
qnsgRFL46lWG
xo1QHOyKS9rj4fjvFs+n
mIHZlAqzS6ymmpMCU1uyZgE=
WCtjiGCFl/4JTiJ0R60=
c0vpAtZ3fY7TeLfdcnASQg==
Y87Xlic9/1+q3g/pUArVoB4=
kKOsRsf05wBOd67a
dDmgYgOZZ0aCMVwgDha4bgc=
ieXCbvcCyja+otcfpw==
Fd0XQwkTHHaBmNDvImbCcgVd
PK/M6eM8xOwqvw==
Pf0q8MdfICMvvQ==
EO8aPQwf7z2Du+XvImbCcgVd
BeUisSg/Ql6uJcg=
ay2v2pz4gomTESLosQ==
AGjX3ak2B+FyQ9ZKrQ==
Du0y0UXomyoxT4/arA8Du3FvpwE=
xhV7OrDTdonq4fjvFs+n
9+s2xTlaW66p2IAAnVkDQA==
AuS2UeN4Nsvl5vo8J67Zf/5a
B1vK2590RiUuuw==
/709BIUfMCIln8sus2u2aAM=
BMpYckjp699wVZfS
Pf2AqIscEhlpHlnV18IvVQk=
RKUTxUbz/zFroN/LLq+kIdZM
IuuiQ9pj7ZzciLVPiks4Rxc=
0KBn8XAV7NNm2xPxuA==
nv7yBtDj4UNE/ju8er1EZSanBXfyLv4=
sBgf41X1vKTwUspTsg==
5bk4+oQWD+X01tBEqQ==
c08KjxWnau8DDSsESMKNI+P5G/6/sYjU6g==
RJiyeEVj/N3rhNAW3qU=
v6O7hhQxA//+Oyq2ms9DWQ==
7MdHCYCb4OT5pg==
Je0NLgIfKIeFuyjxYD+i
68P+tIkhBdlwVZfS
inthecryptolane.com
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ymloqhw.exeymloqhw.exepid process 4880 ymloqhw.exe 4976 ymloqhw.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ymloqhw.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation ymloqhw.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ymloqhw.exeymloqhw.exehelp.exedescription pid process target process PID 4880 set thread context of 4976 4880 ymloqhw.exe ymloqhw.exe PID 4976 set thread context of 2056 4976 ymloqhw.exe Explorer.EXE PID 1476 set thread context of 2056 1476 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
ymloqhw.exehelp.exepid process 4976 ymloqhw.exe 4976 ymloqhw.exe 4976 ymloqhw.exe 4976 ymloqhw.exe 4976 ymloqhw.exe 4976 ymloqhw.exe 4976 ymloqhw.exe 4976 ymloqhw.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
ymloqhw.exeymloqhw.exehelp.exepid process 4880 ymloqhw.exe 4880 ymloqhw.exe 4976 ymloqhw.exe 4976 ymloqhw.exe 4976 ymloqhw.exe 1476 help.exe 1476 help.exe 1476 help.exe 1476 help.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
ymloqhw.exehelp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4976 ymloqhw.exe Token: SeDebugPrivilege 1476 help.exe Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE Token: SeShutdownPrivilege 2056 Explorer.EXE Token: SeCreatePagefilePrivilege 2056 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
b85bcfc355d32617c12a2e71d4f80880.exeymloqhw.exeExplorer.EXEhelp.exedescription pid process target process PID 1572 wrote to memory of 4880 1572 b85bcfc355d32617c12a2e71d4f80880.exe ymloqhw.exe PID 1572 wrote to memory of 4880 1572 b85bcfc355d32617c12a2e71d4f80880.exe ymloqhw.exe PID 1572 wrote to memory of 4880 1572 b85bcfc355d32617c12a2e71d4f80880.exe ymloqhw.exe PID 4880 wrote to memory of 4976 4880 ymloqhw.exe ymloqhw.exe PID 4880 wrote to memory of 4976 4880 ymloqhw.exe ymloqhw.exe PID 4880 wrote to memory of 4976 4880 ymloqhw.exe ymloqhw.exe PID 4880 wrote to memory of 4976 4880 ymloqhw.exe ymloqhw.exe PID 2056 wrote to memory of 1476 2056 Explorer.EXE help.exe PID 2056 wrote to memory of 1476 2056 Explorer.EXE help.exe PID 2056 wrote to memory of 1476 2056 Explorer.EXE help.exe PID 1476 wrote to memory of 4228 1476 help.exe Firefox.exe PID 1476 wrote to memory of 4228 1476 help.exe Firefox.exe PID 1476 wrote to memory of 4228 1476 help.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b85bcfc355d32617c12a2e71d4f80880.exe"C:\Users\Admin\AppData\Local\Temp\b85bcfc355d32617c12a2e71d4f80880.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ymloqhw.exe"C:\Users\Admin\AppData\Local\Temp\ymloqhw.exe" C:\Users\Admin\AppData\Local\Temp\mpghhn.eq3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ymloqhw.exe"C:\Users\Admin\AppData\Local\Temp\ymloqhw.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hpthvgglt.lFilesize
185KB
MD5fb17e00ac583fe89f38f0bbb9ccb8050
SHA1d46337d1555b7e55b0c93119bb64674e76e9d708
SHA25652804ab58a315767b6a1e6aa2d2929c59fcebbf9987c1b1a96b29b5058cd2c2c
SHA5123e7f33d00628e6dc65cae8ddbf6cc84a1ef2ae1216f7f95723f1045f98315361c4339bddae5045ef150052bd4e2212ff751476389da8f2a9abc86b7c841ae739
-
C:\Users\Admin\AppData\Local\Temp\mpghhn.eqFilesize
5KB
MD5c066e7e0e80848e742991ebd6b4312fe
SHA1c837d365515949d61e35166a605019f9577b9755
SHA2561864986a084fa6adcf2e34ca40bbbac13c238af9f9c3238123273bf2875c207c
SHA5126ba1556565903a9bb2754e615d2feade7d14df0b59a48fc68a08a0d9ff6cc8f350f2897ecb04685e3934ca0770d346e858d8e6089b8460d87837e2dbc5dc8f76
-
C:\Users\Admin\AppData\Local\Temp\ymloqhw.exeFilesize
100KB
MD562e7501ba9d2982ab16107c276d2e82a
SHA1ebbb812d6cca55c6756beb4694bd430c54cd2ec9
SHA256633fb361810f5cd64acfda82f0bfd93d26000c397187459b70e0d0ea922e94cf
SHA5121ccc7662c751fec76204bc0db15cbb5ac20854b2c95a9a5cc82b100ae6b4c2ee0d8ad062c30bbc62a7c00884d85409ebfe6b0ce8f20b8b373602b9f4d3238ac6
-
C:\Users\Admin\AppData\Local\Temp\ymloqhw.exeFilesize
100KB
MD562e7501ba9d2982ab16107c276d2e82a
SHA1ebbb812d6cca55c6756beb4694bd430c54cd2ec9
SHA256633fb361810f5cd64acfda82f0bfd93d26000c397187459b70e0d0ea922e94cf
SHA5121ccc7662c751fec76204bc0db15cbb5ac20854b2c95a9a5cc82b100ae6b4c2ee0d8ad062c30bbc62a7c00884d85409ebfe6b0ce8f20b8b373602b9f4d3238ac6
-
C:\Users\Admin\AppData\Local\Temp\ymloqhw.exeFilesize
100KB
MD562e7501ba9d2982ab16107c276d2e82a
SHA1ebbb812d6cca55c6756beb4694bd430c54cd2ec9
SHA256633fb361810f5cd64acfda82f0bfd93d26000c397187459b70e0d0ea922e94cf
SHA5121ccc7662c751fec76204bc0db15cbb5ac20854b2c95a9a5cc82b100ae6b4c2ee0d8ad062c30bbc62a7c00884d85409ebfe6b0ce8f20b8b373602b9f4d3238ac6
-
memory/1476-145-0x0000000000480000-0x0000000000487000-memory.dmpFilesize
28KB
-
memory/1476-149-0x0000000000A40000-0x0000000000ACF000-memory.dmpFilesize
572KB
-
memory/1476-148-0x0000000000500000-0x000000000052D000-memory.dmpFilesize
180KB
-
memory/1476-147-0x0000000000500000-0x000000000052D000-memory.dmpFilesize
180KB
-
memory/1476-146-0x0000000000BB0000-0x0000000000EFA000-memory.dmpFilesize
3.3MB
-
memory/1476-143-0x0000000000000000-mapping.dmp
-
memory/2056-176-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-182-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-222-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-220-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-221-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-219-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-218-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-150-0x0000000008980000-0x0000000008AD3000-memory.dmpFilesize
1.3MB
-
memory/2056-151-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-152-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-153-0x0000000002970000-0x0000000002980000-memory.dmpFilesize
64KB
-
memory/2056-154-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-155-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-156-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-157-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-158-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-159-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-160-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-161-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-162-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-163-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-164-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-165-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-166-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-167-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-168-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-169-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-170-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-171-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-172-0x0000000008980000-0x0000000008AD3000-memory.dmpFilesize
1.3MB
-
memory/2056-173-0x0000000002970000-0x0000000002980000-memory.dmpFilesize
64KB
-
memory/2056-174-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-175-0x0000000007F10000-0x0000000007F20000-memory.dmpFilesize
64KB
-
memory/2056-142-0x00000000085F0000-0x0000000008735000-memory.dmpFilesize
1.3MB
-
memory/2056-177-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-178-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-179-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-180-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-181-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-217-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-183-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-184-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-185-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-186-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-187-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-188-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-189-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-190-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-191-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-192-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-193-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-194-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-195-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-196-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-197-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-198-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/2056-199-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-200-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-201-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-202-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-203-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-204-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-205-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-206-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-207-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/2056-208-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-209-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-211-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-214-0x0000000002AE0000-0x0000000002AF0000-memory.dmpFilesize
64KB
-
memory/2056-215-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-213-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/2056-210-0x0000000002460000-0x0000000002470000-memory.dmpFilesize
64KB
-
memory/4880-132-0x0000000000000000-mapping.dmp
-
memory/4976-144-0x0000000000790000-0x00000000007BF000-memory.dmpFilesize
188KB
-
memory/4976-137-0x0000000000000000-mapping.dmp
-
memory/4976-139-0x0000000000790000-0x00000000007BF000-memory.dmpFilesize
188KB
-
memory/4976-140-0x0000000000DB0000-0x00000000010FA000-memory.dmpFilesize
3.3MB
-
memory/4976-141-0x0000000000C70000-0x0000000000C80000-memory.dmpFilesize
64KB