Resubmissions
23-02-2023 09:07
230223-k3mfeshb8w 1022-02-2023 13:48
230222-q4kacadf71 1021-02-2023 11:15
230221-ncjhmaee87 1021-02-2023 11:01
230221-m4tl8sgd6w 1021-02-2023 09:02
230221-kzr7haga9w 1020-02-2023 12:30
230220-ppg11aba52 10Analysis
-
max time kernel
97s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2023 09:02
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
3.3MB
-
MD5
69df9998a42524225a5b25d2e8a5bd79
-
SHA1
08d01a8d0a17b6d565eeb38e003a79cda4608ab2
-
SHA256
1bf1a0cbe61b5693903760d0bff9c3cb53a7c43061437e367b19a77b55aaadfa
-
SHA512
5b5760e2de414e6fe18df95553b5a1046a613b11252585e35667b804ff06ece7cc210a366509fbf9fb606dd8b5cddd4b613b8d7b70aef431c1241b3dc256d790
-
SSDEEP
49152:9es+BvKs6POj/T3K2Umsv/kd2BEmgNVfDdv3n9RIZqpCatWuOnqdEb+RPz:ksOFVrTa2E/VEmgNVfDx3nTTrEbQPz
Malware Config
Extracted
vidar
2.5
813
-
profile_id
813
Extracted
raccoon
960d8047e2829c4b87de991d706e2490
http://94.142.138.37/
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation file.exe -
Executes dropped EXE 1 IoCs
Processes:
23850152448893641063.exepid process 1752 23850152448893641063.exe -
Loads dropped DLL 7 IoCs
Processes:
file.exe23850152448893641063.exepid process 4892 file.exe 4892 file.exe 1752 23850152448893641063.exe 1752 23850152448893641063.exe 1752 23850152448893641063.exe 1752 23850152448893641063.exe 1752 23850152448893641063.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2656 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
file.exe23850152448893641063.exepid process 4892 file.exe 4892 file.exe 1752 23850152448893641063.exe 1752 23850152448893641063.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
file.execmd.exedescription pid process target process PID 4892 wrote to memory of 1752 4892 file.exe 23850152448893641063.exe PID 4892 wrote to memory of 1752 4892 file.exe 23850152448893641063.exe PID 4892 wrote to memory of 1752 4892 file.exe 23850152448893641063.exe PID 4892 wrote to memory of 1980 4892 file.exe cmd.exe PID 4892 wrote to memory of 1980 4892 file.exe cmd.exe PID 4892 wrote to memory of 1980 4892 file.exe cmd.exe PID 1980 wrote to memory of 2656 1980 cmd.exe timeout.exe PID 1980 wrote to memory of 2656 1980 cmd.exe timeout.exe PID 1980 wrote to memory of 2656 1980 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\23850152448893641063.exe"C:\ProgramData\23850152448893641063.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\file.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\23850152448893641063.exeFilesize
6.6MB
MD5900d27e6128c54af6b69cf16612ef16b
SHA1e21cfcd4e5767612b050ae2fed4868480af4ea1a
SHA25601e388da881c2c5b5689b1c9919ee092ffd24b269e5760159c75b5478d1e4b58
SHA512d4e7feedbe5294093ca4bab47c1285e3bfec493e4fd93289b355e2e056b486fe3addaa132cb03d9db86367a24d8b9129a172d1588c3bbe6abed4cbbbf67ddc5f
-
C:\ProgramData\23850152448893641063.exeFilesize
6.6MB
MD5900d27e6128c54af6b69cf16612ef16b
SHA1e21cfcd4e5767612b050ae2fed4868480af4ea1a
SHA25601e388da881c2c5b5689b1c9919ee092ffd24b269e5760159c75b5478d1e4b58
SHA512d4e7feedbe5294093ca4bab47c1285e3bfec493e4fd93289b355e2e056b486fe3addaa132cb03d9db86367a24d8b9129a172d1588c3bbe6abed4cbbbf67ddc5f
-
C:\ProgramData\23850152448893641063.exeFilesize
6.6MB
MD5900d27e6128c54af6b69cf16612ef16b
SHA1e21cfcd4e5767612b050ae2fed4868480af4ea1a
SHA25601e388da881c2c5b5689b1c9919ee092ffd24b269e5760159c75b5478d1e4b58
SHA512d4e7feedbe5294093ca4bab47c1285e3bfec493e4fd93289b355e2e056b486fe3addaa132cb03d9db86367a24d8b9129a172d1588c3bbe6abed4cbbbf67ddc5f
-
C:\ProgramData\MSVCP140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
C:\ProgramData\VCRUNTIME140.dllFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\msvcp140.dllFilesize
439KB
MD55ff1fca37c466d6723ec67be93b51442
SHA134cc4e158092083b13d67d6d2bc9e57b798a303b
SHA2565136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA5124802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\ProgramData\vcruntime140.dllFilesize
78KB
MD5a37ee36b536409056a86f50e67777dd7
SHA11cafa159292aa736fc595fc04e16325b27cd6750
SHA2568934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA5123a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
-
C:\Users\Admin\AppData\LocalLow\8IVJ7vqtWm6GFilesize
92KB
MD5367544a2a5551a41c869eb1b0b5871c3
SHA19051340b95090c07deda0a1df3a9c0b9233f5054
SHA256eb0e2b2ee04cab66e2f7930ea82a5f1b42469ac50e063a8492f9c585f90bc542
SHA5126d1275291530cb8b9944db296c4aed376765015ad6bbf51f4475a347776c99dbb2e748d0c331d89c9e6118adf641ed10e390c8ccb8ae4de4811c858d195cc34c
-
C:\Users\Admin\AppData\LocalLow\aJp9K44uMZHnFilesize
112KB
MD5780853cddeaee8de70f28a4b255a600b
SHA1ad7a5da33f7ad12946153c497e990720b09005ed
SHA2561055ff62de3dea7645c732583242adf4164bdcfb9dd37d9b35bbb9510d59b0a3
SHA512e422863112084bb8d11c682482e780cd63c2f20c8e3a93ed3b9efd1b04d53eb5d3c8081851ca89b74d66f3d9ab48eb5f6c74550484f46e7c6e460a8250c9b1d8
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
memory/1752-248-0x0000000000FC0000-0x0000000000FC1000-memory.dmpFilesize
4KB
-
memory/1752-249-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/1752-244-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/1752-246-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/1752-247-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/1752-250-0x0000000000400000-0x0000000000E35000-memory.dmpFilesize
10.2MB
-
memory/1752-299-0x0000000061E00000-0x0000000061EF1000-memory.dmpFilesize
964KB
-
memory/1752-243-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/1752-245-0x0000000000F80000-0x0000000000F81000-memory.dmpFilesize
4KB
-
memory/4892-251-0x0000000000400000-0x00000000009B9000-memory.dmpFilesize
5.7MB
-
memory/4892-151-0x0000000050F70000-0x0000000051063000-memory.dmpFilesize
972KB
-
memory/4892-136-0x0000000000400000-0x00000000009B9000-memory.dmpFilesize
5.7MB
-
memory/4892-134-0x0000000000400000-0x00000000009B9000-memory.dmpFilesize
5.7MB
-
memory/4892-133-0x0000000000400000-0x00000000009B9000-memory.dmpFilesize
5.7MB