Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
21-03-2023 14:45
General
-
Target
ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe
-
Size
396KB
-
MD5
8786b658cc8531383511362b788f8f1c
-
SHA1
58da30ee843e7d5f51bdacca1ea495b84a7678fd
-
SHA256
ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059
-
SHA512
d99b28db09067135359de87244a56d039399591d29c0bcf8c7d2163f934a938c4248239d87fcb6e99b9f0bce7132e95d0581ae32e73603af489f8b1444a44f5f
-
SSDEEP
12288:iQi3Qa6m6URA3PhNOZm2K7YOY5p2tpNnnTIg:iQiA5hhVFf4y3Tp
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe"C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-T26B4.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp"C:\Users\Admin\AppData\Local\Temp\is-T26B4.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp" /SL5="$70066,146662,62976,C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0NFK5.tmp\Flabs1.exe"C:\Users\Admin\AppData\Local\Temp\is-0NFK5.tmp\Flabs1.exe" /S /UID=flabs13⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\77-a84f0-04c-28484-c01afca122b1b\Remaegushemae.exe"C:\Users\Admin\AppData\Local\Temp\77-a84f0-04c-28484-c01afca122b1b\Remaegushemae.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400KB
MD5aba25c3c0dcd55cbf0a747a5830a9975
SHA12b86c06327bdb8e38414f5b8d5fd4cab50a22acb
SHA256e66ee4cc2e77c2e507383d72f692ed6992cf313876636410ac2693796f098724
SHA512554e05731d7acac05321ad7d6d571a3d56a31cd88b9c82782d1afcaf35b7ba8aeaedd48625e0fd35f445a91b3cfe05a4675813d7b2c7b934007a56b0215039cd
-
Filesize
400KB
MD5aba25c3c0dcd55cbf0a747a5830a9975
SHA12b86c06327bdb8e38414f5b8d5fd4cab50a22acb
SHA256e66ee4cc2e77c2e507383d72f692ed6992cf313876636410ac2693796f098724
SHA512554e05731d7acac05321ad7d6d571a3d56a31cd88b9c82782d1afcaf35b7ba8aeaedd48625e0fd35f445a91b3cfe05a4675813d7b2c7b934007a56b0215039cd
-
Filesize
400KB
MD5aba25c3c0dcd55cbf0a747a5830a9975
SHA12b86c06327bdb8e38414f5b8d5fd4cab50a22acb
SHA256e66ee4cc2e77c2e507383d72f692ed6992cf313876636410ac2693796f098724
SHA512554e05731d7acac05321ad7d6d571a3d56a31cd88b9c82782d1afcaf35b7ba8aeaedd48625e0fd35f445a91b3cfe05a4675813d7b2c7b934007a56b0215039cd
-
Filesize
1KB
MD598d2687aec923f98c37f7cda8de0eb19
SHA1f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA2568a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA51295c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
-
Filesize
51KB
MD536436ff54b1a85494d0f45e2eb56ff00
SHA12740591af0d924a14a97bd5ca9c4026646279123
SHA256b0a056a309a52900ab6a9f5c01823f2a5bcb864449c36a43d30366977eea8413
SHA512e147e799cd774c836e02dc50fb11cbd98fb540a606ee6a3c39100dfc7498472c537b5daf6484c3b65bf1d8dcfb6816f7d6be25ebbef05c5df1d4c2eb09ecd645
-
Filesize
303KB
MD5ee726f15ff7c438fc1faf75032a81028
SHA186fdbb74d64fce06fe518ee220f5f5bafced7214
SHA2564c78cca2ac2fa4d8f2e0c47e0f2785242825da458f00e5337cd56f157ff4bd97
SHA512d9c16d6e027dadd8f8e7ed90e9993a20c4244dc7475a2e5674c1be7a43218824250a3453f97220a960fd886c0760a32d9cfb848e94055a82f7af3dcc401bb0de
-
Filesize
303KB
MD5ee726f15ff7c438fc1faf75032a81028
SHA186fdbb74d64fce06fe518ee220f5f5bafced7214
SHA2564c78cca2ac2fa4d8f2e0c47e0f2785242825da458f00e5337cd56f157ff4bd97
SHA512d9c16d6e027dadd8f8e7ed90e9993a20c4244dc7475a2e5674c1be7a43218824250a3453f97220a960fd886c0760a32d9cfb848e94055a82f7af3dcc401bb0de
-
Filesize
216KB
MD58f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
Filesize
700KB
MD598d2d99fc3af8c3cf275413037eba7da
SHA1a922a0f5a229990301f0cf53b74c4b69fa9e82e3
SHA256a6657d272d82dc1da0704c458274e4cf1e94a465569bc17abc8e7ae2f5d31003
SHA512125fef09f222e154568b7dcff309381f2f7ca5e3536b98a8995563d642d56a787ba9808a144f6d83e84a2a44e279359213ea034ab7f9637fd43e3952e54a3618
-
Filesize
328KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
424KB
-
Filesize
376KB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
432KB
-
Filesize
392KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
4KB