Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
11-02-2023 09:36
Static task
static1
Behavioral task
behavioral1
Sample
0e5fadebbb63160d78fab09972b795f7.exe
Resource
win7-20220812-en
General
-
Target
0e5fadebbb63160d78fab09972b795f7.exe
-
Size
2.1MB
-
MD5
0e5fadebbb63160d78fab09972b795f7
-
SHA1
64259d7e08928f9b2f5a8639ba970d8f36b904d6
-
SHA256
fc729002ac4f2ca65757920fe60351d318b329d854cbf709addf0761d0c68664
-
SHA512
949ab8bdb2e60941231faa2e744a78c8f7153536013296c459d025ce67ecd7bcf38c8f024fe4d7d79c0cc973781a4725ff07a2d1a32bb9286c0f41fcac6ebe96
-
SSDEEP
49152:LTQrHkWhCQyTmeBm/o56gJetPDI+55De8dKbfstgi/:WCrTPm/osgJi8+fzkfs//
Malware Config
Extracted
bitrat
1.38
101.99.94.203:1234
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0e5fadebbb63160d78fab09972b795f7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 0e5fadebbb63160d78fab09972b795f7.exe -
Processes:
resource yara_rule behavioral2/memory/524-148-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/524-149-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/524-150-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/524-151-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/524-153-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/524-163-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
0e5fadebbb63160d78fab09972b795f7.exepid process 524 0e5fadebbb63160d78fab09972b795f7.exe 524 0e5fadebbb63160d78fab09972b795f7.exe 524 0e5fadebbb63160d78fab09972b795f7.exe 524 0e5fadebbb63160d78fab09972b795f7.exe 524 0e5fadebbb63160d78fab09972b795f7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0e5fadebbb63160d78fab09972b795f7.exedescription pid process target process PID 4880 set thread context of 524 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exe0e5fadebbb63160d78fab09972b795f7.exepid process 1144 powershell.exe 3816 powershell.exe 4880 0e5fadebbb63160d78fab09972b795f7.exe 4880 0e5fadebbb63160d78fab09972b795f7.exe 1144 powershell.exe 3816 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exe0e5fadebbb63160d78fab09972b795f7.exe0e5fadebbb63160d78fab09972b795f7.exedescription pid process Token: SeDebugPrivilege 1144 powershell.exe Token: SeDebugPrivilege 3816 powershell.exe Token: SeDebugPrivilege 4880 0e5fadebbb63160d78fab09972b795f7.exe Token: SeShutdownPrivilege 524 0e5fadebbb63160d78fab09972b795f7.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0e5fadebbb63160d78fab09972b795f7.exepid process 524 0e5fadebbb63160d78fab09972b795f7.exe 524 0e5fadebbb63160d78fab09972b795f7.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
0e5fadebbb63160d78fab09972b795f7.exedescription pid process target process PID 4880 wrote to memory of 1144 4880 0e5fadebbb63160d78fab09972b795f7.exe powershell.exe PID 4880 wrote to memory of 1144 4880 0e5fadebbb63160d78fab09972b795f7.exe powershell.exe PID 4880 wrote to memory of 1144 4880 0e5fadebbb63160d78fab09972b795f7.exe powershell.exe PID 4880 wrote to memory of 3816 4880 0e5fadebbb63160d78fab09972b795f7.exe powershell.exe PID 4880 wrote to memory of 3816 4880 0e5fadebbb63160d78fab09972b795f7.exe powershell.exe PID 4880 wrote to memory of 3816 4880 0e5fadebbb63160d78fab09972b795f7.exe powershell.exe PID 4880 wrote to memory of 3644 4880 0e5fadebbb63160d78fab09972b795f7.exe schtasks.exe PID 4880 wrote to memory of 3644 4880 0e5fadebbb63160d78fab09972b795f7.exe schtasks.exe PID 4880 wrote to memory of 3644 4880 0e5fadebbb63160d78fab09972b795f7.exe schtasks.exe PID 4880 wrote to memory of 3540 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe PID 4880 wrote to memory of 3540 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe PID 4880 wrote to memory of 3540 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe PID 4880 wrote to memory of 524 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe PID 4880 wrote to memory of 524 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe PID 4880 wrote to memory of 524 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe PID 4880 wrote to memory of 524 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe PID 4880 wrote to memory of 524 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe PID 4880 wrote to memory of 524 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe PID 4880 wrote to memory of 524 4880 0e5fadebbb63160d78fab09972b795f7.exe 0e5fadebbb63160d78fab09972b795f7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OHAxhhFlhLD.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OHAxhhFlhLD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmpFilesize
1KB
MD59a53402bd346fdc2a36143ea42a1ae3a
SHA11ad4e9eec239834f340857da46ca9702ecb2cb87
SHA256377f16767d69cbc7e7b3395360f479ae4ad7184544aeb8012f9ece77e0208414
SHA512daeadd9d6945a5c672353541039bc82fb572ddb952422a9e85b59558b7aaffd2a58486bcebee671e86cfe7f60f7c245d9adc0ad4880722f6e23dc9bef0df00b3
-
memory/524-147-0x0000000000000000-mapping.dmp
-
memory/524-163-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/524-159-0x0000000070BC0000-0x0000000070BF9000-memory.dmpFilesize
228KB
-
memory/524-154-0x0000000070C60000-0x0000000070C99000-memory.dmpFilesize
228KB
-
memory/524-153-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/524-151-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/524-150-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/524-149-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/524-148-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1144-140-0x0000000002750000-0x0000000002786000-memory.dmpFilesize
216KB
-
memory/1144-137-0x0000000000000000-mapping.dmp
-
memory/1144-145-0x0000000005A10000-0x0000000005A76000-memory.dmpFilesize
408KB
-
memory/1144-158-0x00000000065F0000-0x000000000660E000-memory.dmpFilesize
120KB
-
memory/1144-156-0x0000000075080000-0x00000000750CC000-memory.dmpFilesize
304KB
-
memory/1144-141-0x00000000052B0000-0x00000000058D8000-memory.dmpFilesize
6.2MB
-
memory/1144-155-0x0000000007040000-0x0000000007072000-memory.dmpFilesize
200KB
-
memory/1144-152-0x0000000006040000-0x000000000605E000-memory.dmpFilesize
120KB
-
memory/1144-161-0x00000000079B0000-0x000000000802A000-memory.dmpFilesize
6.5MB
-
memory/3540-146-0x0000000000000000-mapping.dmp
-
memory/3644-139-0x0000000000000000-mapping.dmp
-
memory/3816-138-0x0000000000000000-mapping.dmp
-
memory/3816-144-0x0000000005210000-0x0000000005276000-memory.dmpFilesize
408KB
-
memory/3816-164-0x0000000007670000-0x0000000007706000-memory.dmpFilesize
600KB
-
memory/3816-157-0x0000000075080000-0x00000000750CC000-memory.dmpFilesize
304KB
-
memory/3816-143-0x0000000004FF0000-0x0000000005012000-memory.dmpFilesize
136KB
-
memory/3816-162-0x0000000007460000-0x000000000746A000-memory.dmpFilesize
40KB
-
memory/3816-160-0x00000000073F0000-0x000000000740A000-memory.dmpFilesize
104KB
-
memory/4880-136-0x0000000009EB0000-0x0000000009F4C000-memory.dmpFilesize
624KB
-
memory/4880-135-0x0000000005B90000-0x0000000005B9A000-memory.dmpFilesize
40KB
-
memory/4880-134-0x0000000005C10000-0x0000000005CA2000-memory.dmpFilesize
584KB
-
memory/4880-132-0x0000000000FE0000-0x00000000011F6000-memory.dmpFilesize
2.1MB
-
memory/4880-133-0x00000000061C0000-0x0000000006764000-memory.dmpFilesize
5.6MB