Analysis
-
max time kernel
68s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 13:25
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
voiceadequovl.exevoiceadequovl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation voiceadequovl.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation voiceadequovl.exe -
Executes dropped EXE 4 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 4912 voiceadequovl.exe 2664 voiceadequovl.exe 3876 voiceadequovl.exe 3956 voiceadequovl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 2664 set thread context of 3956 2664 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exevoiceadequovl.exepowershell.exepid process 1568 powershell.exe 1568 powershell.exe 2664 voiceadequovl.exe 2664 voiceadequovl.exe 3868 powershell.exe 3868 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 2664 voiceadequovl.exe Token: SeDebugPrivilege 1568 powershell.exe Token: SeDebugPrivilege 3868 powershell.exe Token: SeIncreaseQuotaPrivilege 2304 wmic.exe Token: SeSecurityPrivilege 2304 wmic.exe Token: SeTakeOwnershipPrivilege 2304 wmic.exe Token: SeLoadDriverPrivilege 2304 wmic.exe Token: SeSystemProfilePrivilege 2304 wmic.exe Token: SeSystemtimePrivilege 2304 wmic.exe Token: SeProfSingleProcessPrivilege 2304 wmic.exe Token: SeIncBasePriorityPrivilege 2304 wmic.exe Token: SeCreatePagefilePrivilege 2304 wmic.exe Token: SeBackupPrivilege 2304 wmic.exe Token: SeRestorePrivilege 2304 wmic.exe Token: SeShutdownPrivilege 2304 wmic.exe Token: SeDebugPrivilege 2304 wmic.exe Token: SeSystemEnvironmentPrivilege 2304 wmic.exe Token: SeRemoteShutdownPrivilege 2304 wmic.exe Token: SeUndockPrivilege 2304 wmic.exe Token: SeManageVolumePrivilege 2304 wmic.exe Token: 33 2304 wmic.exe Token: 34 2304 wmic.exe Token: 35 2304 wmic.exe Token: 36 2304 wmic.exe Token: SeIncreaseQuotaPrivilege 2304 wmic.exe Token: SeSecurityPrivilege 2304 wmic.exe Token: SeTakeOwnershipPrivilege 2304 wmic.exe Token: SeLoadDriverPrivilege 2304 wmic.exe Token: SeSystemProfilePrivilege 2304 wmic.exe Token: SeSystemtimePrivilege 2304 wmic.exe Token: SeProfSingleProcessPrivilege 2304 wmic.exe Token: SeIncBasePriorityPrivilege 2304 wmic.exe Token: SeCreatePagefilePrivilege 2304 wmic.exe Token: SeBackupPrivilege 2304 wmic.exe Token: SeRestorePrivilege 2304 wmic.exe Token: SeShutdownPrivilege 2304 wmic.exe Token: SeDebugPrivilege 2304 wmic.exe Token: SeSystemEnvironmentPrivilege 2304 wmic.exe Token: SeRemoteShutdownPrivilege 2304 wmic.exe Token: SeUndockPrivilege 2304 wmic.exe Token: SeManageVolumePrivilege 2304 wmic.exe Token: 33 2304 wmic.exe Token: 34 2304 wmic.exe Token: 35 2304 wmic.exe Token: 36 2304 wmic.exe Token: SeIncreaseQuotaPrivilege 4060 WMIC.exe Token: SeSecurityPrivilege 4060 WMIC.exe Token: SeTakeOwnershipPrivilege 4060 WMIC.exe Token: SeLoadDriverPrivilege 4060 WMIC.exe Token: SeSystemProfilePrivilege 4060 WMIC.exe Token: SeSystemtimePrivilege 4060 WMIC.exe Token: SeProfSingleProcessPrivilege 4060 WMIC.exe Token: SeIncBasePriorityPrivilege 4060 WMIC.exe Token: SeCreatePagefilePrivilege 4060 WMIC.exe Token: SeBackupPrivilege 4060 WMIC.exe Token: SeRestorePrivilege 4060 WMIC.exe Token: SeShutdownPrivilege 4060 WMIC.exe Token: SeDebugPrivilege 4060 WMIC.exe Token: SeSystemEnvironmentPrivilege 4060 WMIC.exe Token: SeRemoteShutdownPrivilege 4060 WMIC.exe Token: SeUndockPrivilege 4060 WMIC.exe Token: SeManageVolumePrivilege 4060 WMIC.exe Token: 33 4060 WMIC.exe Token: 34 4060 WMIC.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.execmd.exedescription pid process target process PID 2440 wrote to memory of 4912 2440 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 2440 wrote to memory of 4912 2440 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 2440 wrote to memory of 4912 2440 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 4912 wrote to memory of 2664 4912 voiceadequovl.exe voiceadequovl.exe PID 4912 wrote to memory of 2664 4912 voiceadequovl.exe voiceadequovl.exe PID 4912 wrote to memory of 2664 4912 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 1568 2664 voiceadequovl.exe powershell.exe PID 2664 wrote to memory of 1568 2664 voiceadequovl.exe powershell.exe PID 2664 wrote to memory of 1568 2664 voiceadequovl.exe powershell.exe PID 2664 wrote to memory of 2192 2664 voiceadequovl.exe cmd.exe PID 2664 wrote to memory of 2192 2664 voiceadequovl.exe cmd.exe PID 2664 wrote to memory of 2192 2664 voiceadequovl.exe cmd.exe PID 2192 wrote to memory of 3868 2192 cmd.exe powershell.exe PID 2192 wrote to memory of 3868 2192 cmd.exe powershell.exe PID 2192 wrote to memory of 3868 2192 cmd.exe powershell.exe PID 2664 wrote to memory of 3876 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3876 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3876 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 2664 wrote to memory of 3956 2664 voiceadequovl.exe voiceadequovl.exe PID 3956 wrote to memory of 2304 3956 voiceadequovl.exe wmic.exe PID 3956 wrote to memory of 2304 3956 voiceadequovl.exe wmic.exe PID 3956 wrote to memory of 2304 3956 voiceadequovl.exe wmic.exe PID 3956 wrote to memory of 1192 3956 voiceadequovl.exe cmd.exe PID 3956 wrote to memory of 1192 3956 voiceadequovl.exe cmd.exe PID 3956 wrote to memory of 1192 3956 voiceadequovl.exe cmd.exe PID 1192 wrote to memory of 4060 1192 cmd.exe WMIC.exe PID 1192 wrote to memory of 4060 1192 cmd.exe WMIC.exe PID 1192 wrote to memory of 4060 1192 cmd.exe WMIC.exe PID 3956 wrote to memory of 1412 3956 voiceadequovl.exe cmd.exe PID 3956 wrote to memory of 1412 3956 voiceadequovl.exe cmd.exe PID 3956 wrote to memory of 1412 3956 voiceadequovl.exe cmd.exe PID 1412 wrote to memory of 4964 1412 cmd.exe WMIC.exe PID 1412 wrote to memory of 4964 1412 cmd.exe WMIC.exe PID 1412 wrote to memory of 4964 1412 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD58ca0bc3be3325c957199884413460f07
SHA1b722b745a11eeb9729af5166bf1bfa615c977e34
SHA25660ab170c1d131d51d72db43ca9d4beb6b00076625c00826f97aaf4fe6b3ed51a
SHA512cccd4feeb4129232f3a118a014ed7a9750fe5551b5e2df5c34b04733c923e2c014fc2659c529417c523bb8a4da8d7fccc700bad4d84ab2430eb03b9a552f1376
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
334.6MB
MD5b8d81a3b130377669b4929993b339ec8
SHA1c5b57971584e06dedb521de936de257815fe7a29
SHA256e7ee343aff03b95779eec8da0be8f1341b66008b9c60281a4705ece8b53c218e
SHA5123bde4b4bf4dc33c188a079eb4f91818bda2bae10b5ebcd620d29295538d54a6caeb9e254e47a561d15091abeb25b840d55572f1cc4e26f1cc6bc2160eb3e23a7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
325.1MB
MD5a86784bb28a698ef02243ed88082097f
SHA1c6b13e845cc72789f5a7a3c5dc1113b4bfae5f70
SHA2569dab7f8bfad9ab41b2791aa512e7b42f3f9dde29227a2e23d7b5c4f4ec4415ac
SHA512dc1fccdb963b8aef6f34ebf3a7ba32ed1d55e8bfda03f9092b34cf67c7ffc9869622e85da1aadd360563bdd8bd9c1f43538c8d1715777da08ecb3f3fb5f0cd16
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
312.7MB
MD52a1480975d44941fbd70d4c924d045cf
SHA1cfa9a2c91eb8fa7056413e717211485dbdef1f70
SHA256e7a83ed58b5ce694665b2a8e5cc617ea9c85fd382fd0172da54abf2db3162e99
SHA5127f64ea63f96f9753d4c3f913745c95f146c948461790fd6e6f0b8e8ebed0003267fca9b46e37b1e50b96d63832ac5e21adbc50b94c3079064a4c77f713d75a3f
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
309.1MB
MD53ccae81ac10a8cbfb364c130aa781dd0
SHA16437406c7c8c9e17e0a9950dee7a4bf6fadc6031
SHA2561b090f4693d568813c0f7144a39888178d33694d889347c7cf4bce17996a2399
SHA5122d1eee891d19c60812617b903389d1a69862a8dd5f5e2c74a8b3ada147a3fda0ecc234e8367de7ac39237e69ae2beb61ac735eaf5479832ac56035123658b61a
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
178.4MB
MD5d6bc392b638c44f60681982b871fcb3b
SHA18c06041dd7c2894f850c522a3a126838b3ec87e4
SHA256d1d7fb67c24395e0f6fbde3a4009881a8e9ebd2ed5d4a0f89713bd08cd294153
SHA5126020e4c0101a5f7d5744eaf4a793a768a3afe3b0ed12b4e8b99d057f7bc84e47e1f8767e800aa9e827c34bac0e389e13c5d4a3d774aa005a5316dedd1a809d03
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
175.7MB
MD591bc4c5762c068b279a5df98f01348f6
SHA1bad0ce46214ef25223a14fdcc25a3290be5d7639
SHA2566a413febe4f1ead04488ae7bd601cfcc9993b0213c20d1d4e300cf95ed064f2a
SHA512759250bac905336f3a832bdfc3848d85c283981264ff712701304c457c3521b0f2926d0755756a22939048c777f464baeb80aa72da7e28dc4dd0e4d09f8d25fa
-
memory/1192-166-0x0000000000000000-mapping.dmp
-
memory/1412-169-0x0000000000000000-mapping.dmp
-
memory/1568-144-0x0000000005CC0000-0x0000000005D26000-memory.dmpFilesize
408KB
-
memory/1568-143-0x0000000005BE0000-0x0000000005C46000-memory.dmpFilesize
408KB
-
memory/1568-145-0x00000000062D0000-0x00000000062EE000-memory.dmpFilesize
120KB
-
memory/1568-146-0x0000000007920000-0x0000000007F9A000-memory.dmpFilesize
6.5MB
-
memory/1568-147-0x00000000067E0000-0x00000000067FA000-memory.dmpFilesize
104KB
-
memory/1568-142-0x0000000005440000-0x0000000005A68000-memory.dmpFilesize
6.2MB
-
memory/1568-141-0x0000000002CF0000-0x0000000002D26000-memory.dmpFilesize
216KB
-
memory/1568-140-0x0000000000000000-mapping.dmp
-
memory/2192-148-0x0000000000000000-mapping.dmp
-
memory/2304-161-0x0000000000000000-mapping.dmp
-
memory/2664-139-0x0000000006F20000-0x0000000006F42000-memory.dmpFilesize
136KB
-
memory/2664-138-0x0000000000860000-0x0000000000FD4000-memory.dmpFilesize
7.5MB
-
memory/2664-135-0x0000000000000000-mapping.dmp
-
memory/3868-163-0x0000000072470000-0x00000000724BC000-memory.dmpFilesize
304KB
-
memory/3868-168-0x0000000007B30000-0x0000000007BC6000-memory.dmpFilesize
600KB
-
memory/3868-173-0x0000000007A70000-0x0000000007A78000-memory.dmpFilesize
32KB
-
memory/3868-172-0x0000000007A90000-0x0000000007AAA000-memory.dmpFilesize
104KB
-
memory/3868-162-0x0000000007530000-0x0000000007562000-memory.dmpFilesize
200KB
-
memory/3868-171-0x00000000063A0000-0x00000000063AE000-memory.dmpFilesize
56KB
-
memory/3868-164-0x0000000006AD0000-0x0000000006AEE000-memory.dmpFilesize
120KB
-
memory/3868-165-0x00000000078F0000-0x00000000078FA000-memory.dmpFilesize
40KB
-
memory/3868-149-0x0000000000000000-mapping.dmp
-
memory/3876-150-0x0000000000000000-mapping.dmp
-
memory/3956-153-0x0000000000000000-mapping.dmp
-
memory/3956-158-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3956-154-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3956-157-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/3956-174-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/4060-167-0x0000000000000000-mapping.dmp
-
memory/4912-132-0x0000000000000000-mapping.dmp
-
memory/4964-170-0x0000000000000000-mapping.dmp