Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17/03/2023, 17:38
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
296KB
-
MD5
8ee319a68644628af5df86add9dc87cd
-
SHA1
e04fd5d186041e8423c0407ca3d2b844f2123c32
-
SHA256
ccd1cde08e07f3be31008ea2b7ace4190317f179c3a75e0b9e88670aa70626cb
-
SHA512
cbdf160308a8c1d9a78e0f2c8dadf7e65661e9d564497e17c92be1ab7423ad5db256166180285074b9843add81648d20ff2438f44ba69990195a48f6a376a6a6
-
SSDEEP
3072:Z0kKKgML7DG7uJAj7VDpo18Ur4+f6trQ2KmknjpBv8sVHI4yjitchauM:imgML7C7uJo7/+f6G2K7jpBv8Gupcu
Malware Config
Extracted
laplas
http://45.87.154.105
-
api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767
Signatures
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 632 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1928 DAKEBAKFHC.exe 756 ntlhost.exe -
Loads dropped DLL 6 IoCs
pid Process 1992 file.exe 1992 file.exe 1756 cmd.exe 1756 cmd.exe 1928 DAKEBAKFHC.exe 1928 DAKEBAKFHC.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" DAKEBAKFHC.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1204 timeout.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 6 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1992 file.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1756 1992 file.exe 30 PID 1992 wrote to memory of 1756 1992 file.exe 30 PID 1992 wrote to memory of 1756 1992 file.exe 30 PID 1992 wrote to memory of 1756 1992 file.exe 30 PID 1992 wrote to memory of 632 1992 file.exe 32 PID 1992 wrote to memory of 632 1992 file.exe 32 PID 1992 wrote to memory of 632 1992 file.exe 32 PID 1992 wrote to memory of 632 1992 file.exe 32 PID 632 wrote to memory of 1204 632 cmd.exe 34 PID 632 wrote to memory of 1204 632 cmd.exe 34 PID 632 wrote to memory of 1204 632 cmd.exe 34 PID 632 wrote to memory of 1204 632 cmd.exe 34 PID 1756 wrote to memory of 1928 1756 cmd.exe 35 PID 1756 wrote to memory of 1928 1756 cmd.exe 35 PID 1756 wrote to memory of 1928 1756 cmd.exe 35 PID 1756 wrote to memory of 1928 1756 cmd.exe 35 PID 1928 wrote to memory of 756 1928 DAKEBAKFHC.exe 36 PID 1928 wrote to memory of 756 1928 DAKEBAKFHC.exe 36 PID 1928 wrote to memory of 756 1928 DAKEBAKFHC.exe 36 PID 1928 wrote to memory of 756 1928 DAKEBAKFHC.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DAKEBAKFHC.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\DAKEBAKFHC.exe"C:\Users\Admin\AppData\Local\Temp\DAKEBAKFHC.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe4⤵
- Executes dropped EXE
PID:756
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\file.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1204
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5d433fee70e60de32de4608f07bed7d2a
SHA18b84224c8319705317340392ad99bc529183a7db
SHA2560a93f3cfdedbd88dce010e4a2e54dc8c2a2135e58f037b55a513ed8b1dc49cb7
SHA512ec62acdea29ce1c56f09729c8e0832ffbd95755746305a35b0c361c92a03c88c8efb1c14eff35a9bdde26f965cd743408cacc08a5b2eb317a067fc876b9844d8
-
Filesize
1.8MB
MD5d433fee70e60de32de4608f07bed7d2a
SHA18b84224c8319705317340392ad99bc529183a7db
SHA2560a93f3cfdedbd88dce010e4a2e54dc8c2a2135e58f037b55a513ed8b1dc49cb7
SHA512ec62acdea29ce1c56f09729c8e0832ffbd95755746305a35b0c361c92a03c88c8efb1c14eff35a9bdde26f965cd743408cacc08a5b2eb317a067fc876b9844d8
-
Filesize
440.8MB
MD55ee1ce178fc66274194fa269c2a40415
SHA110a3ef8222529c0192e4abe25fec71d7edda20a1
SHA256a8075acb48c453e6b8bc7f06387a45883dad577305dd2a89aa8734135bfa1a8d
SHA512bdea9f6dc55418156c1c8786e7bde050a17b38e400de90557e399c28865419d2157b504704596a73002725a0fd4e4c5dffea0bc509cd9103e9f62007bb62bb54
-
Filesize
334.8MB
MD58283783bcca6c637ace3df0c28f4780f
SHA119f773bf796eae1376f349f4a5ffaec800bb8291
SHA25657fa5992d5bdf744b355102aeb58798ea669291a6c8b135b3e5c28e4854959d9
SHA512401040ef31c9ee169706fdbc4bc2e787ce3053679214a79bdf606c7866245497054b6edfd12bfd40a42b1d1fcbc03f679e73f2fb8be94482462e48c7481f457c
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
1.8MB
MD5d433fee70e60de32de4608f07bed7d2a
SHA18b84224c8319705317340392ad99bc529183a7db
SHA2560a93f3cfdedbd88dce010e4a2e54dc8c2a2135e58f037b55a513ed8b1dc49cb7
SHA512ec62acdea29ce1c56f09729c8e0832ffbd95755746305a35b0c361c92a03c88c8efb1c14eff35a9bdde26f965cd743408cacc08a5b2eb317a067fc876b9844d8
-
Filesize
1.8MB
MD5d433fee70e60de32de4608f07bed7d2a
SHA18b84224c8319705317340392ad99bc529183a7db
SHA2560a93f3cfdedbd88dce010e4a2e54dc8c2a2135e58f037b55a513ed8b1dc49cb7
SHA512ec62acdea29ce1c56f09729c8e0832ffbd95755746305a35b0c361c92a03c88c8efb1c14eff35a9bdde26f965cd743408cacc08a5b2eb317a067fc876b9844d8
-
Filesize
448.0MB
MD5dccdb86427b178939198ae966505ead9
SHA1092f5380fc345721367cc2edfe21a3bd3f2ace18
SHA2562eddde87be5e063b678e444eb874fdc8be1069b53a9a7b2e69a332f5c4f8e56c
SHA512d6b090a971ece58ba3fd64733d569f22949c197cf392ef8c032aeed4ade3cd396c3443dcce9f2f7e5e8f5265d8935e67e87d183aa4ff37130ae357b9929211e4
-
Filesize
363.8MB
MD548f0cc71200a739c01a4bd5ad4f77220
SHA128888d8e522a81481ad6faa634ea54b67947364a
SHA25648656b19b71b535a0358a17a437250e0ea37daa3658ad054d632caa7eb9f7368
SHA512d2160d2b4236d789ced239d9f079d00a57d97ac8e2ace69733fdbc249c5a508c4910edf0db5bf7405f655821629871acb4c92efe384b38b244f01936870fced4