Analysis
-
max time kernel
62s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 07:20
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220901-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
voiceadequovl.exevoiceadequovl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 3 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 4744 voiceadequovl.exe 3256 voiceadequovl.exe 2468 voiceadequovl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 3256 set thread context of 2468 3256 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2936 powershell.exe 2936 powershell.exe 4640 powershell.exe 4640 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3256 voiceadequovl.exe Token: SeDebugPrivilege 2936 powershell.exe Token: SeDebugPrivilege 4640 powershell.exe Token: SeIncreaseQuotaPrivilege 2372 wmic.exe Token: SeSecurityPrivilege 2372 wmic.exe Token: SeTakeOwnershipPrivilege 2372 wmic.exe Token: SeLoadDriverPrivilege 2372 wmic.exe Token: SeSystemProfilePrivilege 2372 wmic.exe Token: SeSystemtimePrivilege 2372 wmic.exe Token: SeProfSingleProcessPrivilege 2372 wmic.exe Token: SeIncBasePriorityPrivilege 2372 wmic.exe Token: SeCreatePagefilePrivilege 2372 wmic.exe Token: SeBackupPrivilege 2372 wmic.exe Token: SeRestorePrivilege 2372 wmic.exe Token: SeShutdownPrivilege 2372 wmic.exe Token: SeDebugPrivilege 2372 wmic.exe Token: SeSystemEnvironmentPrivilege 2372 wmic.exe Token: SeRemoteShutdownPrivilege 2372 wmic.exe Token: SeUndockPrivilege 2372 wmic.exe Token: SeManageVolumePrivilege 2372 wmic.exe Token: 33 2372 wmic.exe Token: 34 2372 wmic.exe Token: 35 2372 wmic.exe Token: 36 2372 wmic.exe Token: SeIncreaseQuotaPrivilege 2372 wmic.exe Token: SeSecurityPrivilege 2372 wmic.exe Token: SeTakeOwnershipPrivilege 2372 wmic.exe Token: SeLoadDriverPrivilege 2372 wmic.exe Token: SeSystemProfilePrivilege 2372 wmic.exe Token: SeSystemtimePrivilege 2372 wmic.exe Token: SeProfSingleProcessPrivilege 2372 wmic.exe Token: SeIncBasePriorityPrivilege 2372 wmic.exe Token: SeCreatePagefilePrivilege 2372 wmic.exe Token: SeBackupPrivilege 2372 wmic.exe Token: SeRestorePrivilege 2372 wmic.exe Token: SeShutdownPrivilege 2372 wmic.exe Token: SeDebugPrivilege 2372 wmic.exe Token: SeSystemEnvironmentPrivilege 2372 wmic.exe Token: SeRemoteShutdownPrivilege 2372 wmic.exe Token: SeUndockPrivilege 2372 wmic.exe Token: SeManageVolumePrivilege 2372 wmic.exe Token: 33 2372 wmic.exe Token: 34 2372 wmic.exe Token: 35 2372 wmic.exe Token: 36 2372 wmic.exe Token: SeIncreaseQuotaPrivilege 2464 WMIC.exe Token: SeSecurityPrivilege 2464 WMIC.exe Token: SeTakeOwnershipPrivilege 2464 WMIC.exe Token: SeLoadDriverPrivilege 2464 WMIC.exe Token: SeSystemProfilePrivilege 2464 WMIC.exe Token: SeSystemtimePrivilege 2464 WMIC.exe Token: SeProfSingleProcessPrivilege 2464 WMIC.exe Token: SeIncBasePriorityPrivilege 2464 WMIC.exe Token: SeCreatePagefilePrivilege 2464 WMIC.exe Token: SeBackupPrivilege 2464 WMIC.exe Token: SeRestorePrivilege 2464 WMIC.exe Token: SeShutdownPrivilege 2464 WMIC.exe Token: SeDebugPrivilege 2464 WMIC.exe Token: SeSystemEnvironmentPrivilege 2464 WMIC.exe Token: SeRemoteShutdownPrivilege 2464 WMIC.exe Token: SeUndockPrivilege 2464 WMIC.exe Token: SeManageVolumePrivilege 2464 WMIC.exe Token: 33 2464 WMIC.exe Token: 34 2464 WMIC.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.execmd.exedescription pid process target process PID 4992 wrote to memory of 4744 4992 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4992 wrote to memory of 4744 4992 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4992 wrote to memory of 4744 4992 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4744 wrote to memory of 3256 4744 voiceadequovl.exe voiceadequovl.exe PID 4744 wrote to memory of 3256 4744 voiceadequovl.exe voiceadequovl.exe PID 4744 wrote to memory of 3256 4744 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2936 3256 voiceadequovl.exe powershell.exe PID 3256 wrote to memory of 2936 3256 voiceadequovl.exe powershell.exe PID 3256 wrote to memory of 2936 3256 voiceadequovl.exe powershell.exe PID 3256 wrote to memory of 4700 3256 voiceadequovl.exe cmd.exe PID 3256 wrote to memory of 4700 3256 voiceadequovl.exe cmd.exe PID 3256 wrote to memory of 4700 3256 voiceadequovl.exe cmd.exe PID 4700 wrote to memory of 4640 4700 cmd.exe powershell.exe PID 4700 wrote to memory of 4640 4700 cmd.exe powershell.exe PID 4700 wrote to memory of 4640 4700 cmd.exe powershell.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 3256 wrote to memory of 2468 3256 voiceadequovl.exe voiceadequovl.exe PID 2468 wrote to memory of 2372 2468 voiceadequovl.exe wmic.exe PID 2468 wrote to memory of 2372 2468 voiceadequovl.exe wmic.exe PID 2468 wrote to memory of 2372 2468 voiceadequovl.exe wmic.exe PID 2468 wrote to memory of 4264 2468 voiceadequovl.exe cmd.exe PID 2468 wrote to memory of 4264 2468 voiceadequovl.exe cmd.exe PID 2468 wrote to memory of 4264 2468 voiceadequovl.exe cmd.exe PID 4264 wrote to memory of 2464 4264 cmd.exe WMIC.exe PID 4264 wrote to memory of 2464 4264 cmd.exe WMIC.exe PID 4264 wrote to memory of 2464 4264 cmd.exe WMIC.exe PID 2468 wrote to memory of 1736 2468 voiceadequovl.exe cmd.exe PID 2468 wrote to memory of 1736 2468 voiceadequovl.exe cmd.exe PID 2468 wrote to memory of 1736 2468 voiceadequovl.exe cmd.exe PID 1736 wrote to memory of 2064 1736 cmd.exe WMIC.exe PID 1736 wrote to memory of 2064 1736 cmd.exe WMIC.exe PID 1736 wrote to memory of 2064 1736 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD597937ef682495316c84053d366f59c1e
SHA1c0a5b494745c04c1b079c58eccbe9faeec33e6ee
SHA2561da1e6c05bd2d39e1c1458aa28e3bcf5a2b898b872ab29f7fb640fd6f9d5c22a
SHA512ff91739dae62e7b755149d6d2adb526e2c9e43da0842d969683ee9e70354c0ca836ec8de5a27dac39d09b3a1c345f6b8c7e8e4765e2b82dd72b997eeb23e38fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
361.4MB
MD5bfdce5583af4f67df737b541942b74d7
SHA17989e2cd2870faf30e10082df602a5687e4a00d6
SHA25685f82b995397fe2d170edf931337d328faa11db58bb2666997b8254b97160ea0
SHA5123121ef49c40d2e344fa3d59efd40b762b82089360c54504256a3e2bea502a20bd5889ce8e7be7ff23b4a319f764269eaa1eb328ebb628b670202143417b49c9b
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
369.8MB
MD514a9737eb666769fee7c28a00eb14e82
SHA1ab8f2279f13a546fc32233a4da0855660fb07ec0
SHA256a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a
SHA512973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
232.2MB
MD52f639f3f7db187ea4ba840210fc08fba
SHA1de165dea392355a6c633c8d4806c8ee12529971a
SHA256b86a4d72d5d270f81ecc8d79bca8b36d21957bec7f113db6e4c2dba6b4585e79
SHA512e20fe4346cbccef00374dc4f2c4c34d38932caecfe56df74ee113835529351da07660f814b6e6abfd4e19f0aa67cae27537ec841816b78813a2c4b72c47f0153
-
memory/1736-166-0x0000000000000000-mapping.dmp
-
memory/2064-167-0x0000000000000000-mapping.dmp
-
memory/2372-158-0x0000000000000000-mapping.dmp
-
memory/2464-164-0x0000000000000000-mapping.dmp
-
memory/2468-156-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/2468-172-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/2468-155-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/2468-152-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/2468-151-0x0000000000000000-mapping.dmp
-
memory/2936-142-0x00000000056D0000-0x0000000005CF8000-memory.dmpFilesize
6.2MB
-
memory/2936-141-0x0000000002A20000-0x0000000002A56000-memory.dmpFilesize
216KB
-
memory/2936-140-0x0000000000000000-mapping.dmp
-
memory/2936-147-0x0000000006840000-0x000000000685A000-memory.dmpFilesize
104KB
-
memory/2936-146-0x0000000007BB0000-0x000000000822A000-memory.dmpFilesize
6.5MB
-
memory/2936-145-0x0000000006350000-0x000000000636E000-memory.dmpFilesize
120KB
-
memory/2936-144-0x0000000005D00000-0x0000000005D66000-memory.dmpFilesize
408KB
-
memory/2936-143-0x00000000054B0000-0x0000000005516000-memory.dmpFilesize
408KB
-
memory/3256-139-0x00000000073A0000-0x00000000073C2000-memory.dmpFilesize
136KB
-
memory/3256-135-0x0000000000000000-mapping.dmp
-
memory/3256-138-0x0000000000CE0000-0x0000000001454000-memory.dmpFilesize
7.5MB
-
memory/4264-162-0x0000000000000000-mapping.dmp
-
memory/4640-165-0x0000000007C20000-0x0000000007C2A000-memory.dmpFilesize
40KB
-
memory/4640-163-0x0000000006D30000-0x0000000006D4E000-memory.dmpFilesize
120KB
-
memory/4640-149-0x0000000000000000-mapping.dmp
-
memory/4640-161-0x0000000070660000-0x00000000706AC000-memory.dmpFilesize
304KB
-
memory/4640-168-0x0000000007E70000-0x0000000007F06000-memory.dmpFilesize
600KB
-
memory/4640-169-0x0000000006700000-0x000000000670E000-memory.dmpFilesize
56KB
-
memory/4640-170-0x0000000007DF0000-0x0000000007E0A000-memory.dmpFilesize
104KB
-
memory/4640-171-0x0000000007DD0000-0x0000000007DD8000-memory.dmpFilesize
32KB
-
memory/4640-160-0x0000000006DD0000-0x0000000006E02000-memory.dmpFilesize
200KB
-
memory/4700-148-0x0000000000000000-mapping.dmp
-
memory/4744-132-0x0000000000000000-mapping.dmp