Analysis
-
max time kernel
78s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 13:12
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
voiceadequovl.exevoiceadequovl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 3 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 5044 voiceadequovl.exe 3644 voiceadequovl.exe 3896 voiceadequovl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 3644 set thread context of 3896 3644 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2200 powershell.exe 2200 powershell.exe 2532 powershell.exe 2532 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3644 voiceadequovl.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2532 powershell.exe Token: SeIncreaseQuotaPrivilege 4460 wmic.exe Token: SeSecurityPrivilege 4460 wmic.exe Token: SeTakeOwnershipPrivilege 4460 wmic.exe Token: SeLoadDriverPrivilege 4460 wmic.exe Token: SeSystemProfilePrivilege 4460 wmic.exe Token: SeSystemtimePrivilege 4460 wmic.exe Token: SeProfSingleProcessPrivilege 4460 wmic.exe Token: SeIncBasePriorityPrivilege 4460 wmic.exe Token: SeCreatePagefilePrivilege 4460 wmic.exe Token: SeBackupPrivilege 4460 wmic.exe Token: SeRestorePrivilege 4460 wmic.exe Token: SeShutdownPrivilege 4460 wmic.exe Token: SeDebugPrivilege 4460 wmic.exe Token: SeSystemEnvironmentPrivilege 4460 wmic.exe Token: SeRemoteShutdownPrivilege 4460 wmic.exe Token: SeUndockPrivilege 4460 wmic.exe Token: SeManageVolumePrivilege 4460 wmic.exe Token: 33 4460 wmic.exe Token: 34 4460 wmic.exe Token: 35 4460 wmic.exe Token: 36 4460 wmic.exe Token: SeIncreaseQuotaPrivilege 4460 wmic.exe Token: SeSecurityPrivilege 4460 wmic.exe Token: SeTakeOwnershipPrivilege 4460 wmic.exe Token: SeLoadDriverPrivilege 4460 wmic.exe Token: SeSystemProfilePrivilege 4460 wmic.exe Token: SeSystemtimePrivilege 4460 wmic.exe Token: SeProfSingleProcessPrivilege 4460 wmic.exe Token: SeIncBasePriorityPrivilege 4460 wmic.exe Token: SeCreatePagefilePrivilege 4460 wmic.exe Token: SeBackupPrivilege 4460 wmic.exe Token: SeRestorePrivilege 4460 wmic.exe Token: SeShutdownPrivilege 4460 wmic.exe Token: SeDebugPrivilege 4460 wmic.exe Token: SeSystemEnvironmentPrivilege 4460 wmic.exe Token: SeRemoteShutdownPrivilege 4460 wmic.exe Token: SeUndockPrivilege 4460 wmic.exe Token: SeManageVolumePrivilege 4460 wmic.exe Token: 33 4460 wmic.exe Token: 34 4460 wmic.exe Token: 35 4460 wmic.exe Token: 36 4460 wmic.exe Token: SeIncreaseQuotaPrivilege 3860 WMIC.exe Token: SeSecurityPrivilege 3860 WMIC.exe Token: SeTakeOwnershipPrivilege 3860 WMIC.exe Token: SeLoadDriverPrivilege 3860 WMIC.exe Token: SeSystemProfilePrivilege 3860 WMIC.exe Token: SeSystemtimePrivilege 3860 WMIC.exe Token: SeProfSingleProcessPrivilege 3860 WMIC.exe Token: SeIncBasePriorityPrivilege 3860 WMIC.exe Token: SeCreatePagefilePrivilege 3860 WMIC.exe Token: SeBackupPrivilege 3860 WMIC.exe Token: SeRestorePrivilege 3860 WMIC.exe Token: SeShutdownPrivilege 3860 WMIC.exe Token: SeDebugPrivilege 3860 WMIC.exe Token: SeSystemEnvironmentPrivilege 3860 WMIC.exe Token: SeRemoteShutdownPrivilege 3860 WMIC.exe Token: SeUndockPrivilege 3860 WMIC.exe Token: SeManageVolumePrivilege 3860 WMIC.exe Token: 33 3860 WMIC.exe Token: 34 3860 WMIC.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.execmd.exedescription pid process target process PID 4276 wrote to memory of 5044 4276 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4276 wrote to memory of 5044 4276 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4276 wrote to memory of 5044 4276 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 5044 wrote to memory of 3644 5044 voiceadequovl.exe voiceadequovl.exe PID 5044 wrote to memory of 3644 5044 voiceadequovl.exe voiceadequovl.exe PID 5044 wrote to memory of 3644 5044 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 2200 3644 voiceadequovl.exe powershell.exe PID 3644 wrote to memory of 2200 3644 voiceadequovl.exe powershell.exe PID 3644 wrote to memory of 2200 3644 voiceadequovl.exe powershell.exe PID 3644 wrote to memory of 4172 3644 voiceadequovl.exe cmd.exe PID 3644 wrote to memory of 4172 3644 voiceadequovl.exe cmd.exe PID 3644 wrote to memory of 4172 3644 voiceadequovl.exe cmd.exe PID 4172 wrote to memory of 2532 4172 cmd.exe powershell.exe PID 4172 wrote to memory of 2532 4172 cmd.exe powershell.exe PID 4172 wrote to memory of 2532 4172 cmd.exe powershell.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3644 wrote to memory of 3896 3644 voiceadequovl.exe voiceadequovl.exe PID 3896 wrote to memory of 4460 3896 voiceadequovl.exe wmic.exe PID 3896 wrote to memory of 4460 3896 voiceadequovl.exe wmic.exe PID 3896 wrote to memory of 4460 3896 voiceadequovl.exe wmic.exe PID 3896 wrote to memory of 3364 3896 voiceadequovl.exe cmd.exe PID 3896 wrote to memory of 3364 3896 voiceadequovl.exe cmd.exe PID 3896 wrote to memory of 3364 3896 voiceadequovl.exe cmd.exe PID 3364 wrote to memory of 3860 3364 cmd.exe WMIC.exe PID 3364 wrote to memory of 3860 3364 cmd.exe WMIC.exe PID 3364 wrote to memory of 3860 3364 cmd.exe WMIC.exe PID 3896 wrote to memory of 2228 3896 voiceadequovl.exe cmd.exe PID 3896 wrote to memory of 2228 3896 voiceadequovl.exe cmd.exe PID 3896 wrote to memory of 2228 3896 voiceadequovl.exe cmd.exe PID 2228 wrote to memory of 2128 2228 cmd.exe WMIC.exe PID 2228 wrote to memory of 2128 2228 cmd.exe WMIC.exe PID 2228 wrote to memory of 2128 2228 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD51970134382c0fd073f91056818eac9ef
SHA1521583f90f141fa142e381cb9d8597bb19722ba2
SHA256060430399c52c35497b532be6cbf0cec7115248749ec76e5aafb9346f05ffa21
SHA5126e748638786a69209433250dbc4ac76ea647b3a9c955bb7077a52fbb087c5492b7f8fc3ad8485ff9231d37558c9f9b368a7facf17b78e0826e031f287be111b0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
360.7MB
MD519d3f3b1a780220919d22452ee5d86d0
SHA1bcac019bd029dab9555bdab832ba88c182f96855
SHA25646d1cc9c9481429856ccc5a6429aff911882d81fa4782bb0d05b2da3a85e5c61
SHA5127b8df149fca08adf8d91b36fab88e7fa20d2a0f9fca7ecae6eb6ce4177dc6acb2e128a663bbb3513ced84d1df41f69864bbc5b2b02b11ba5d55b0135f074240a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
345.9MB
MD546da932049579f269139e32e2378fc52
SHA1d21f31a09c2f5ee20b414df051ad49c120c9afc8
SHA25607273579b45a715552b41d56529e3df0e3d56206f78cbb5efd9152d7f14f0b44
SHA5129ae687a9c378781874abdf1524253a865c7e8322c9f0ffdb4d84f6e3b071239ce018f3723cbeb6d8e62e9dd16565efb4eb478957e566882c020464e6d70a268c
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
318.6MB
MD5597f5dea80c0d7608ecb2bffa968c76b
SHA18bd9d5b1fb9d970058daeee143cd19197c4d7b07
SHA2564810932571fa943fa016e6e0b897e51542c85d0741083ef58f4d36033117149e
SHA5121c87269771a4a58ac06251f236561129ff1d787816116d9625d3e9dc24e9c8953281a8b65afa678e4c55c2432d8c4f2fee39bc19e3905d030e45805b32799bc3
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
351.6MB
MD5704f529bf8a4efd125e3cf98349c5a88
SHA150d9e69ab77c80d96a3285386165e0f9c3b95b16
SHA256e07072cbfebb5eb6732aa2ba2c6513f8196429bfac902f164dbf69d56ff95db9
SHA51257d2faae7bdbb2dfac6f72494c0d4c49b36a40b38122e8802b54a65de7a067cadc8b79690e4b23c633e6f6e73ec3aac2de72e8f9f8311052aa88074bf06c11e7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
128.8MB
MD5f0bb2454e04804a60159225f9d6a2555
SHA10908fa2fb52696d973f3dbbed7aca94f440cf9d8
SHA256a6354d36ff7604685421e9c09055030b8bc9eeb243cc4ed4b2f3cf8276b2f8e4
SHA5120da6c3a4bbad328345315a5445ffbbb63eea2b5d2ee3e66f08483e43ed5e2a02bfe7909cee6777c8ede8a9374ba53d6bb9f11bd87ef5c5474ff175f7d7d6514a
-
memory/2128-168-0x0000000000000000-mapping.dmp
-
memory/2200-140-0x0000000000000000-mapping.dmp
-
memory/2200-142-0x0000000005590000-0x0000000005BB8000-memory.dmpFilesize
6.2MB
-
memory/2200-143-0x00000000053D0000-0x0000000005436000-memory.dmpFilesize
408KB
-
memory/2200-144-0x0000000005CC0000-0x0000000005D26000-memory.dmpFilesize
408KB
-
memory/2200-145-0x0000000006310000-0x000000000632E000-memory.dmpFilesize
120KB
-
memory/2200-146-0x0000000007950000-0x0000000007FCA000-memory.dmpFilesize
6.5MB
-
memory/2200-147-0x0000000006810000-0x000000000682A000-memory.dmpFilesize
104KB
-
memory/2200-141-0x00000000029F0000-0x0000000002A26000-memory.dmpFilesize
216KB
-
memory/2228-167-0x0000000000000000-mapping.dmp
-
memory/2532-163-0x0000000006CF0000-0x0000000006CFA000-memory.dmpFilesize
40KB
-
memory/2532-162-0x00000000060D0000-0x00000000060EE000-memory.dmpFilesize
120KB
-
memory/2532-171-0x0000000006D30000-0x0000000006D38000-memory.dmpFilesize
32KB
-
memory/2532-149-0x0000000000000000-mapping.dmp
-
memory/2532-170-0x0000000006D50000-0x0000000006D6A000-memory.dmpFilesize
104KB
-
memory/2532-169-0x00000000059D0000-0x00000000059DE000-memory.dmpFilesize
56KB
-
memory/2532-165-0x0000000007180000-0x0000000007216000-memory.dmpFilesize
600KB
-
memory/2532-159-0x00000000060F0000-0x0000000006122000-memory.dmpFilesize
200KB
-
memory/2532-161-0x0000000073230000-0x000000007327C000-memory.dmpFilesize
304KB
-
memory/3364-164-0x0000000000000000-mapping.dmp
-
memory/3644-138-0x00000000007E0000-0x0000000000F54000-memory.dmpFilesize
7.5MB
-
memory/3644-139-0x0000000006EC0000-0x0000000006EE2000-memory.dmpFilesize
136KB
-
memory/3644-135-0x0000000000000000-mapping.dmp
-
memory/3860-166-0x0000000000000000-mapping.dmp
-
memory/3896-157-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3896-151-0x0000000000000000-mapping.dmp
-
memory/3896-155-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3896-152-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3896-172-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/4172-148-0x0000000000000000-mapping.dmp
-
memory/4460-160-0x0000000000000000-mapping.dmp
-
memory/5044-132-0x0000000000000000-mapping.dmp