Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 05:45
Static task
static1
Behavioral task
behavioral1
Sample
27bb66e7e3ff9b2094fb568e243c1d20.exe
Resource
win7-20230220-en
General
-
Target
27bb66e7e3ff9b2094fb568e243c1d20.exe
-
Size
307KB
-
MD5
27bb66e7e3ff9b2094fb568e243c1d20
-
SHA1
58ccfc20f2240af3bf98fc7121cfafb0c2a6f833
-
SHA256
9223ea1f88d99f8c593d7f8b888df49378bbdad7ba3a3a21cd762ea390f7c28d
-
SHA512
bc7e55c3bb2fbd5ffe58ef69b935b26ce0e893a37ac038733420b8335bce06a2a7beebde745760586a309af0bdadfc42c444f8d6e7d7886b0e2c10858d17d1f2
-
SSDEEP
6144:/Ya6/om87RH3+UAHQlFVTgy0vSRyPtZQA39ee8GDKkNKpd2DryescPi:/YdoV7p3MuF9WKIPtZb97DKfp1Aq
Malware Config
Extracted
formbook
dcn0
ZVx68vDtAMBCwg==
oBMBvsNORkM/O/ox
Ff9pISWkm6eG4lByIspp
c2T42c6CIIF6B8xTxm9XzpVw
bvjhxRbnAC183w==
0lTttSNG4HUDNflyIspp
hPXFlstqiHA/O/ox
WLR+MeerxZ0cNn1ja+IQAYo=
IHRn4xXOVKi477zarG+ObSy7YJA=
Xhf3e+tdAC183w==
Xk0ZAezv2rWH
kngo+vBeSRN7AszNwam3Osmguuqc0MoC
a2Qp7a+E8fSw7LDjpnqEKjsRZA==
3zjy4E7+QM48wg==
YcCmqT3OUNAigVott2pBKiy7YJA=
4+SMeX1juat/5cZ1AZihcyy7YJA=
/+m7sro0OBTl3TMpCw==
i2ctEfe4//a64yklMsgS2J90
+loZ2QKGX0UWgpvErMs=
b9BNCnJWQJS8IfsR0uR3bCy7YJA=
9eiUYE0ynHE/O/ox
F2/75pOIYNg0hzOD99192J8=
Y1xOONdO105okfha33EZ2A==
qYZIIB+dfF0wp1nVWFz067hJ2/qoXEVeAA==
moQMzat7tfKyKPYs
aMZJI/NfUSSpPQUBJ8/11g==
QKMN15GjpHcpyA==
6+S1hTvphhFfoCdj6tw=
DPynhWcnZWho7a0p33EZ2A==
EXY//zDm7ej3Guwo
PSWxPYkk0SNioSdj6tw=
jv+tmhv1ySZloydj6tw=
P8GUV5BhNZflCCBBFg==
IQZ0PWog1lcVVkJYHg==
aOTCq/Cet6AdhSdj6tw=
OBzJrqYS+eac46nZo4aI84kWMEtH
kBzTkbI2LTo/O/ox
a8pwOrU/tyx93a/QrGBpXGQIfZI=
GWoC9K5Mx0GR34urFcDPyQ==
dGxKGM2FI4iAkTOD99192J8=
UqQv8Vkx7WzkCCBBFg==
NcBsPK+YmdZP0cyhY+Lrzw==
zcKbk5oK7NCgFOpa4tHv0g==
uIomFkUTzdWa
QkAF8NuWMZmnPjCFgJBa+Y1t
51w6Gw7c3NyY
IyDnsW89dXaMrAxotF8jGZc=
1s1RHCrCwI8PnVhMY+Lrzw==
zBnRazUUWCsrM5t0SEth
1z4R/XM98Wn3j1RMY+Lrzw==
h3b34yQL3cI8wg==
/+27PhUTzdWa
CO0jnOIoAC183w==
Cn8jz+pyZEfWCCBBFg==
jI4f4NnKFwoSUb4YbnkzePzLv+Sc0MoC
xZnrS1Y+5Sxv1g==
phjYsTTGW8zAMydj6tw=
v7JcJyW3x64phzOD99192J8=
tBJ+Uh3sJxYqbyvrfF6BKjsRZA==
xRTxyfuTgMhGxg==
6ceNTfir2qmQHtxWwqIrI8GQ7h/Te/A2CA==
00gVx7d5/U5soCdj6tw=
Jgvgt58H8MFLfBzTp1VZXCe2ZYg=
1NKRY1QTzdWa
ahmedo.ch
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
kmdgiiip.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation kmdgiiip.exe -
Executes dropped EXE 2 IoCs
Processes:
kmdgiiip.exekmdgiiip.exepid process 4308 kmdgiiip.exe 436 kmdgiiip.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
kmdgiiip.exekmdgiiip.exemsdt.exedescription pid process target process PID 4308 set thread context of 436 4308 kmdgiiip.exe kmdgiiip.exe PID 436 set thread context of 3148 436 kmdgiiip.exe Explorer.EXE PID 964 set thread context of 3148 964 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
msdt.exedescription ioc process Key created \Registry\User\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
kmdgiiip.exemsdt.exepid process 436 kmdgiiip.exe 436 kmdgiiip.exe 436 kmdgiiip.exe 436 kmdgiiip.exe 436 kmdgiiip.exe 436 kmdgiiip.exe 436 kmdgiiip.exe 436 kmdgiiip.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3148 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
kmdgiiip.exekmdgiiip.exemsdt.exepid process 4308 kmdgiiip.exe 436 kmdgiiip.exe 436 kmdgiiip.exe 436 kmdgiiip.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe 964 msdt.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
kmdgiiip.exemsdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 436 kmdgiiip.exe Token: SeDebugPrivilege 964 msdt.exe Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE Token: SeShutdownPrivilege 3148 Explorer.EXE Token: SeCreatePagefilePrivilege 3148 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3148 Explorer.EXE 3148 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
27bb66e7e3ff9b2094fb568e243c1d20.exekmdgiiip.exeExplorer.EXEmsdt.exedescription pid process target process PID 1336 wrote to memory of 4308 1336 27bb66e7e3ff9b2094fb568e243c1d20.exe kmdgiiip.exe PID 1336 wrote to memory of 4308 1336 27bb66e7e3ff9b2094fb568e243c1d20.exe kmdgiiip.exe PID 1336 wrote to memory of 4308 1336 27bb66e7e3ff9b2094fb568e243c1d20.exe kmdgiiip.exe PID 4308 wrote to memory of 436 4308 kmdgiiip.exe kmdgiiip.exe PID 4308 wrote to memory of 436 4308 kmdgiiip.exe kmdgiiip.exe PID 4308 wrote to memory of 436 4308 kmdgiiip.exe kmdgiiip.exe PID 4308 wrote to memory of 436 4308 kmdgiiip.exe kmdgiiip.exe PID 3148 wrote to memory of 964 3148 Explorer.EXE msdt.exe PID 3148 wrote to memory of 964 3148 Explorer.EXE msdt.exe PID 3148 wrote to memory of 964 3148 Explorer.EXE msdt.exe PID 964 wrote to memory of 1504 964 msdt.exe Firefox.exe PID 964 wrote to memory of 1504 964 msdt.exe Firefox.exe PID 964 wrote to memory of 1504 964 msdt.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27bb66e7e3ff9b2094fb568e243c1d20.exe"C:\Users\Admin\AppData\Local\Temp\27bb66e7e3ff9b2094fb568e243c1d20.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exe"C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exe" C:\Users\Admin\AppData\Local\Temp\gwobocms.rto3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exe"C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gwobocms.rtoFilesize
5KB
MD5fe6fcfefa38bab70b5a5de603030ff61
SHA13dda65557dc6ce0955f01f1d100ad7700ae4baef
SHA256225d9b3a3361c769ce75cc5940e5075e5d5548030ba2681736a3b403dcae59f7
SHA512ad19cca6697f91da5148f7ddcaf91fe8ea1c43053da21720d4ba39c7b7660f5f9434e463a701b5163fed6940efa2fc8ee945a2706646b9ec6363a600613a5725
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
C:\Users\Admin\AppData\Local\Temp\kmdgiiip.exeFilesize
122KB
MD5fbf3b6215ccf43a9f8bd094dd30315a5
SHA14ba70897d79deab49c1002eb359e81bf75447578
SHA2560c874caffd22395e3abdef0a3da851237942f3a2db7b4ab2e9ca9e9da4a57ff7
SHA5120d3fee9351238880555e20d6606ab8064871f6588292c56490d6e07f7a3a20f050fa26732cf80e880ec037ab839a791277b6ad154eb02e26fb72b9cd214abc66
-
C:\Users\Admin\AppData\Local\Temp\wfcbdjdnov.eeFilesize
204KB
MD54931431215e9651423864a58443356c8
SHA1d3c37dc4a5cb932ccb57241cdb5db5f98fe58cbf
SHA256e03aa0023fa3257acab678ce97eb39ac4d5c576815241e306cb232906d4e8918
SHA5124dbb1a6e89d46b4beadbe3763a1da60c8c886531acb39d5a35d1675d2edd0f3d9b77b5ef8fa80f36e5e07758dd08bdd1e9d82f2b5e9259059a8f8122f0dd510a
-
memory/436-141-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/436-145-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/436-146-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/436-147-0x0000000000E40000-0x000000000118A000-memory.dmpFilesize
3.3MB
-
memory/436-148-0x00000000005F0000-0x0000000000600000-memory.dmpFilesize
64KB
-
memory/964-150-0x0000000000A90000-0x0000000000AE7000-memory.dmpFilesize
348KB
-
memory/964-151-0x0000000000A90000-0x0000000000AE7000-memory.dmpFilesize
348KB
-
memory/964-152-0x0000000000430000-0x000000000045D000-memory.dmpFilesize
180KB
-
memory/964-153-0x0000000002560000-0x00000000028AA000-memory.dmpFilesize
3.3MB
-
memory/964-154-0x0000000000430000-0x000000000045D000-memory.dmpFilesize
180KB
-
memory/964-156-0x0000000002300000-0x000000000238F000-memory.dmpFilesize
572KB
-
memory/3148-149-0x0000000002EC0000-0x0000000002FE5000-memory.dmpFilesize
1.1MB
-
memory/3148-157-0x00000000094B0000-0x0000000009631000-memory.dmpFilesize
1.5MB
-
memory/3148-158-0x00000000094B0000-0x0000000009631000-memory.dmpFilesize
1.5MB
-
memory/3148-160-0x00000000094B0000-0x0000000009631000-memory.dmpFilesize
1.5MB
-
memory/3148-168-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-169-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-170-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-171-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-172-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-173-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-174-0x0000000007650000-0x0000000007660000-memory.dmpFilesize
64KB
-
memory/3148-175-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-176-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-177-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-178-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-179-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-180-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-181-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-182-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-183-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-184-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-185-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/3148-187-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/3148-188-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/3148-194-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-195-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-196-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-197-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-198-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-199-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-200-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-201-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-203-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-202-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-204-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-205-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-206-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-207-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-208-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-209-0x0000000007640000-0x0000000007650000-memory.dmpFilesize
64KB
-
memory/3148-210-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/3148-211-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/3148-212-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/3148-214-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/3148-215-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB
-
memory/3148-216-0x0000000007680000-0x0000000007690000-memory.dmpFilesize
64KB