Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2023 08:15
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
General
-
Target
file.exe
-
Size
235KB
-
MD5
f9167334aa7188f57755ebe55a4e98a2
-
SHA1
d340ed530dd32829f614bd0d0850cc51f8e4ac4b
-
SHA256
7ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f
-
SHA512
ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256
-
SSDEEP
6144:RSRg+A7AZGFDubDXagraG0JzSRuVyLWNgrQqgE:RPsEjgwJ4uVyCNKJ
Malware Config
Extracted
amadey
3.66
62.204.41.92/so57Nst/index.php
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
nbveek.exenbveek.exenbveek.exepid process 4056 nbveek.exe 960 nbveek.exe 2512 nbveek.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exenbveek.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation nbveek.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 516 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
file.exenbveek.execmd.exedescription pid process target process PID 4460 wrote to memory of 4056 4460 file.exe nbveek.exe PID 4460 wrote to memory of 4056 4460 file.exe nbveek.exe PID 4460 wrote to memory of 4056 4460 file.exe nbveek.exe PID 4056 wrote to memory of 2120 4056 nbveek.exe schtasks.exe PID 4056 wrote to memory of 2120 4056 nbveek.exe schtasks.exe PID 4056 wrote to memory of 2120 4056 nbveek.exe schtasks.exe PID 4056 wrote to memory of 4912 4056 nbveek.exe cmd.exe PID 4056 wrote to memory of 4912 4056 nbveek.exe cmd.exe PID 4056 wrote to memory of 4912 4056 nbveek.exe cmd.exe PID 4912 wrote to memory of 1960 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 1960 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 1960 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 4916 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4916 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4916 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4856 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4856 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4856 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 5116 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 5116 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 5116 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 4832 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4832 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4832 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 1964 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 1964 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 1964 4912 cmd.exe cacls.exe PID 4056 wrote to memory of 516 4056 nbveek.exe rundll32.exe PID 4056 wrote to memory of 516 4056 nbveek.exe rundll32.exe PID 4056 wrote to memory of 516 4056 nbveek.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exeFilesize
235KB
MD5f9167334aa7188f57755ebe55a4e98a2
SHA1d340ed530dd32829f614bd0d0850cc51f8e4ac4b
SHA2567ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f
SHA512ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exeFilesize
235KB
MD5f9167334aa7188f57755ebe55a4e98a2
SHA1d340ed530dd32829f614bd0d0850cc51f8e4ac4b
SHA2567ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f
SHA512ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exeFilesize
235KB
MD5f9167334aa7188f57755ebe55a4e98a2
SHA1d340ed530dd32829f614bd0d0850cc51f8e4ac4b
SHA2567ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f
SHA512ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exeFilesize
235KB
MD5f9167334aa7188f57755ebe55a4e98a2
SHA1d340ed530dd32829f614bd0d0850cc51f8e4ac4b
SHA2567ae0570fa1bd29b8fbc977038bc08390aaae3f630bb74df9574fcb73e7c8066f
SHA512ea9c86619d9a7fe752948a265a528bc7c63faa4df7555b626ae42da993efd3c0587d20a9a32e85a7ad77e1d3b7aa299f769907c6a9f95cb592079e49c13f5256
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD5ceed9963147776251f456f01ad11a741
SHA1c52aa99aa7d0d6c27aeb740017f84b56e5ae9350
SHA2561df2a7888b8fc78d43b3a58788d1dddf388c07d7bd0f80606528d5beb74ddcc2
SHA51252f646e75945e02c35d5d2e74d389ffa03341bae137959ccd53a6caedf7eb0a502c5d2b5d1cfbf26879936f9c2bc80f207bdc42027eceaee143b77d6f51e893c
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD5ceed9963147776251f456f01ad11a741
SHA1c52aa99aa7d0d6c27aeb740017f84b56e5ae9350
SHA2561df2a7888b8fc78d43b3a58788d1dddf388c07d7bd0f80606528d5beb74ddcc2
SHA51252f646e75945e02c35d5d2e74d389ffa03341bae137959ccd53a6caedf7eb0a502c5d2b5d1cfbf26879936f9c2bc80f207bdc42027eceaee143b77d6f51e893c
-
memory/516-144-0x0000000000000000-mapping.dmp
-
memory/1960-137-0x0000000000000000-mapping.dmp
-
memory/1964-142-0x0000000000000000-mapping.dmp
-
memory/2120-135-0x0000000000000000-mapping.dmp
-
memory/4056-132-0x0000000000000000-mapping.dmp
-
memory/4832-141-0x0000000000000000-mapping.dmp
-
memory/4856-139-0x0000000000000000-mapping.dmp
-
memory/4912-136-0x0000000000000000-mapping.dmp
-
memory/4916-138-0x0000000000000000-mapping.dmp
-
memory/5116-140-0x0000000000000000-mapping.dmp