830fbd90ec6f2efa388b16778f8eab47df5b3dd07fcd80c576d738af4a76c12a

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe
Size

396KB
MD5

8786b658cc8531383511362b788f8f1c
SHA1

58da30ee843e7d5f51bdacca1ea495b84a7678fd
SHA256

ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059
SHA512

d99b28db09067135359de87244a56d039399591d29c0bcf8c7d2163f934a938c4248239d87fcb6e99b9f0bce7132e95d0581ae32e73603af489f8b1444a44f5f
SSDEEP

12288:iQi3Qa6m6URA3PhNOZm2K7YOY5p2tpNnnTIg:iQiA5hhVFf4y3Tp

Score

9^/10

evasion persistence

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

Flabs1.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts Flabs1.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Flabs1.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation Flabs1.exe
Executes dropped EXE 3 IoCs

Processes:

ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmpFlabs1.exeRemaegushemae.exe

pid process

4368 ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
112 Flabs1.exe
3528 Remaegushemae.exe
Loads dropped DLL 1 IoCs

Processes:

ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp

pid process

4368 ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Flabs1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Flabs1.exe

pid	process
4368	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
112	Flabs1.exe
3528	Remaegushemae.exe

pid	process
4368	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Flabs1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Media Player\\Remaegushemae.exe\""	Flabs1.exe

Drops file in Program Files directory 3 IoCs

Processes:

Flabs1.exe

description	ioc	process
File created	C:\Program Files\Windows Mail\NRGIYYWIKE\poweroff.exe	Flabs1.exe
File created	C:\Program Files (x86)\Windows Media Player\Remaegushemae.exe	Flabs1.exe
File created	C:\Program Files (x86)\Windows Media Player\Remaegushemae.exe.config	Flabs1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Remaegushemae.exe

pid	process
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe
3528	Remaegushemae.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Flabs1.exeRemaegushemae.exe

description pid process

Token: SeDebugPrivilege 112 Flabs1.exe
Token: SeDebugPrivilege 3528 Remaegushemae.exe

description	pid	process
Token: SeDebugPrivilege	112	Flabs1.exe
Token: SeDebugPrivilege	3528	Remaegushemae.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exead4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmpFlabs1.exe

description	pid	process	target process
PID 1436 wrote to memory of 4368	1436	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
PID 1436 wrote to memory of 4368	1436	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
PID 1436 wrote to memory of 4368	1436	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
PID 4368 wrote to memory of 112	4368	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp	Flabs1.exe
PID 4368 wrote to memory of 112	4368	ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp	Flabs1.exe
PID 112 wrote to memory of 3528	112	Flabs1.exe	Remaegushemae.exe
PID 112 wrote to memory of 3528	112	Flabs1.exe	Remaegushemae.exe

C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe
"C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Local\Temp\is-T26B4.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
"C:\Users\Admin\AppData\Local\Temp\is-T26B4.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp" /SL5="$70066,146662,62976,C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4368

C:\Users\Admin\AppData\Local\Temp\is-0NFK5.tmp\Flabs1.exe
"C:\Users\Admin\AppData\Local\Temp\is-0NFK5.tmp\Flabs1.exe" /S /UID=flabs1
3⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112

C:\Users\Admin\AppData\Local\Temp\77-a84f0-04c-28484-c01afca122b1b\Remaegushemae.exe
"C:\Users\Admin\AppData\Local\Temp\77-a84f0-04c-28484-c01afca122b1b\Remaegushemae.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Software Discovery

T1518

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\77-a84f0-04c-28484-c01afca122b1b\Remaegushemae.exe
Filesize
400KB

MD5
aba25c3c0dcd55cbf0a747a5830a9975

SHA1
2b86c06327bdb8e38414f5b8d5fd4cab50a22acb

SHA256
e66ee4cc2e77c2e507383d72f692ed6992cf313876636410ac2693796f098724

SHA512
554e05731d7acac05321ad7d6d571a3d56a31cd88b9c82782d1afcaf35b7ba8aeaedd48625e0fd35f445a91b3cfe05a4675813d7b2c7b934007a56b0215039cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\77-a84f0-04c-28484-c01afca122b1b\Remaegushemae.exe
Filesize
400KB

MD5
aba25c3c0dcd55cbf0a747a5830a9975

SHA1
2b86c06327bdb8e38414f5b8d5fd4cab50a22acb

SHA256
e66ee4cc2e77c2e507383d72f692ed6992cf313876636410ac2693796f098724

SHA512
554e05731d7acac05321ad7d6d571a3d56a31cd88b9c82782d1afcaf35b7ba8aeaedd48625e0fd35f445a91b3cfe05a4675813d7b2c7b934007a56b0215039cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\77-a84f0-04c-28484-c01afca122b1b\Remaegushemae.exe
Filesize
400KB

MD5
aba25c3c0dcd55cbf0a747a5830a9975

SHA1
2b86c06327bdb8e38414f5b8d5fd4cab50a22acb

SHA256
e66ee4cc2e77c2e507383d72f692ed6992cf313876636410ac2693796f098724

SHA512
554e05731d7acac05321ad7d6d571a3d56a31cd88b9c82782d1afcaf35b7ba8aeaedd48625e0fd35f445a91b3cfe05a4675813d7b2c7b934007a56b0215039cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\77-a84f0-04c-28484-c01afca122b1b\Remaegushemae.exe.config
Filesize
1KB

MD5
98d2687aec923f98c37f7cda8de0eb19

SHA1
f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

SHA256
8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

SHA512
95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

Download Submit
C:\Users\Admin\AppData\Local\Temp\79-90988-d25-c0eac-32e1915f74ea6\Remaegushemae.exe
Filesize
51KB

MD5
36436ff54b1a85494d0f45e2eb56ff00

SHA1
2740591af0d924a14a97bd5ca9c4026646279123

SHA256
b0a056a309a52900ab6a9f5c01823f2a5bcb864449c36a43d30366977eea8413

SHA512
e147e799cd774c836e02dc50fb11cbd98fb540a606ee6a3c39100dfc7498472c537b5daf6484c3b65bf1d8dcfb6816f7d6be25ebbef05c5df1d4c2eb09ecd645

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0NFK5.tmp\Flabs1.exe
Filesize
303KB

MD5
ee726f15ff7c438fc1faf75032a81028

SHA1
86fdbb74d64fce06fe518ee220f5f5bafced7214

SHA256
4c78cca2ac2fa4d8f2e0c47e0f2785242825da458f00e5337cd56f157ff4bd97

SHA512
d9c16d6e027dadd8f8e7ed90e9993a20c4244dc7475a2e5674c1be7a43218824250a3453f97220a960fd886c0760a32d9cfb848e94055a82f7af3dcc401bb0de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0NFK5.tmp\Flabs1.exe
Filesize
303KB

MD5
ee726f15ff7c438fc1faf75032a81028

SHA1
86fdbb74d64fce06fe518ee220f5f5bafced7214

SHA256
4c78cca2ac2fa4d8f2e0c47e0f2785242825da458f00e5337cd56f157ff4bd97

SHA512
d9c16d6e027dadd8f8e7ed90e9993a20c4244dc7475a2e5674c1be7a43218824250a3453f97220a960fd886c0760a32d9cfb848e94055a82f7af3dcc401bb0de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0NFK5.tmp\idp.dll
Filesize
216KB

MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-T26B4.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
Filesize
700KB

MD5
98d2d99fc3af8c3cf275413037eba7da

SHA1
a922a0f5a229990301f0cf53b74c4b69fa9e82e3

SHA256
a6657d272d82dc1da0704c458274e4cf1e94a465569bc17abc8e7ae2f5d31003

SHA512
125fef09f222e154568b7dcff309381f2f7ca5e3536b98a8995563d642d56a787ba9808a144f6d83e84a2a44e279359213ea034ab7f9637fd43e3952e54a3618

Download Submit
memory/112-161-0x00000000002B0000-0x0000000000302000-memory.dmp

Filesize
328KB

Download
memory/112-162-0x000000001C630000-0x000000001C640000-memory.dmp

Filesize
64KB

Download
memory/112-190-0x000000001C630000-0x000000001C640000-memory.dmp

Filesize
64KB

Download
memory/1436-147-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1436-212-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1436-133-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3528-179-0x00000000002C0000-0x000000000032A000-memory.dmp

Filesize
424KB

Download
memory/3528-188-0x000000001F150000-0x000000001F1AE000-memory.dmp

Filesize
376KB

Download
memory/3528-183-0x000000001B960000-0x000000001BE2E000-memory.dmp

Filesize
4.8MB

Download
memory/3528-184-0x000000001BFD0000-0x000000001C06C000-memory.dmp

Filesize
624KB

Download
memory/3528-185-0x0000000000AB0000-0x0000000000AB8000-memory.dmp

Filesize
32KB

Download
memory/3528-194-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Filesize
64KB

Download
memory/3528-187-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Filesize
64KB

Download
memory/3528-182-0x0000000000C00000-0x0000000000C6C000-memory.dmp

Filesize
432KB

Download
memory/3528-189-0x000000001FCF0000-0x000000001FD52000-memory.dmp

Filesize
392KB

Download
memory/3528-181-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Filesize
64KB

Download
memory/3528-192-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Filesize
64KB

Download
memory/4368-186-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4368-148-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4368-210-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4368-138-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download