Overview
overview
10Static
static
10Endermanch...is.exe
windows7-x64
1Endermanch...is.exe
windows10-2004-x64
Endermanch...ug.exe
windows7-x64
6Endermanch...ug.exe
windows10-2004-x64
6Endermanch...ck.exe
windows7-x64
7Endermanch...ck.exe
windows10-2004-x64
7Endermanch...om.exe
windows7-x64
1Endermanch...om.exe
windows10-2004-x64
1Endermanch...le.exe
windows7-x64
1Endermanch...le.exe
windows10-2004-x64
1Endermanch...er.exe
windows7-x64
7Endermanch...er.exe
windows10-2004-x64
7Endermanch...er.exe
windows7-x64
7Endermanch...er.exe
windows10-2004-x64
7Endermanch...er.exe
windows7-x64
Endermanch...er.exe
windows10-2004-x64
Endermanch...us.exe
windows7-x64
1Endermanch...us.exe
windows10-2004-x64
1Endermanch....C.exe
windows7-x64
10Endermanch....C.exe
windows10-2004-x64
10Endermanch...rd.exe
windows7-x64
10Endermanch...rd.exe
windows10-2004-x64
9Endermanch...a2.exe
windows7-x64
1Endermanch...a2.exe
windows10-2004-x64
1Endermanch...19.exe
windows7-x64
7Endermanch...19.exe
windows10-2004-x64
7Endermanch...eg.exe
windows7-x64
7Endermanch...eg.exe
windows10-2004-x64
3Endermanch...1).exe
windows7-x64
3Endermanch...1).exe
windows10-2004-x64
3Endermanch...ld.exe
windows7-x64
3Endermanch...ld.exe
windows10-2004-x64
3Resubmissions
10-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 1024-07-2023 06:25
230724-g6s6laag35 1022-07-2023 15:57
230722-tee6wabg5w 1020-07-2023 23:19
230720-3bb5gsbf5v 1020-07-2023 23:06
230720-23f23sba63 1003-02-2021 11:43
210203-6bgge2nfan 1022-11-2020 06:42
201122-6x1at779dj 10Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2023 06:25
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@CleanThis.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Endermanch@CleanThis.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Endermanch@ColorBug.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
Endermanch@ColorBug.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Endermanch@DeriaLock.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Endermanch@DeriaLock.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Endermanch@Deskbottom.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
Endermanch@Deskbottom.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Endermanch@DesktopPuzzle.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
Endermanch@DesktopPuzzle.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
Endermanch@HMBlocker.exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
Endermanch@HMBlocker.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Endermanch@HappyAntivirus.exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
Endermanch@HappyAntivirus.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
Endermanch@Illerka.C.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
Endermanch@Illerka.C.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
Endermanch@Koteyka2.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
Endermanch@Koteyka2.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
Endermanch@LPS2019.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
Endermanch@LPS2019.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
Endermanch@Movie.mpeg.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
Endermanch@Movie.mpeg.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
Endermanch@NavaShield(1).exe
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
Endermanch@NavaShield(1).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
Endermanch@NavaShield.exe
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
Endermanch@NavaShield.exe
Resource
win10v2004-20230703-en
General
-
Target
Endermanch@FakeAdwCleaner.exe
-
Size
190KB
-
MD5
248aadd395ffa7ffb1670392a9398454
-
SHA1
c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5
-
SHA256
51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc
-
SHA512
582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e
-
SSDEEP
3072:15TDpNFVbxDSXJFFGhcBR1WLZ37p73G8Wn7GlDOg+ELqdSxo5XtIZjnvxRJgghaR:157TcfFPB6B3GL7g+me5aZjn5VlI9T/
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Endermanch@FakeAdwCleaner.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation Endermanch@FakeAdwCleaner.exe -
Executes dropped EXE 1 IoCs
Processes:
6AdwCleaner.exepid process 112 6AdwCleaner.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6AdwCleaner.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto" 6AdwCleaner.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6AdwCleaner.exedescription pid process Token: SeDebugPrivilege 112 6AdwCleaner.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6AdwCleaner.exepid process 112 6AdwCleaner.exe 112 6AdwCleaner.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Endermanch@FakeAdwCleaner.exedescription pid process target process PID 3876 wrote to memory of 112 3876 Endermanch@FakeAdwCleaner.exe 6AdwCleaner.exe PID 3876 wrote to memory of 112 3876 Endermanch@FakeAdwCleaner.exe 6AdwCleaner.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@FakeAdwCleaner.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@FakeAdwCleaner.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\6AdwCleaner.exe"C:\Users\Admin\AppData\Local\6AdwCleaner.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\6AdwCleaner.exeFilesize
168KB
MD587e4959fefec297ebbf42de79b5c88f6
SHA1eba50d6b266b527025cd624003799bdda9a6bc86
SHA2564f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61
SHA512232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9
-
C:\Users\Admin\AppData\Local\6AdwCleaner.exeFilesize
168KB
MD587e4959fefec297ebbf42de79b5c88f6
SHA1eba50d6b266b527025cd624003799bdda9a6bc86
SHA2564f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61
SHA512232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9
-
C:\Users\Admin\AppData\Local\6AdwCleaner.exeFilesize
168KB
MD587e4959fefec297ebbf42de79b5c88f6
SHA1eba50d6b266b527025cd624003799bdda9a6bc86
SHA2564f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61
SHA512232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9
-
memory/112-144-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/112-145-0x00007FFE287B0000-0x00007FFE29271000-memory.dmpFilesize
10.8MB
-
memory/112-146-0x000000001ADE0000-0x000000001ADF0000-memory.dmpFilesize
64KB
-
memory/112-147-0x000000001ADE0000-0x000000001ADF0000-memory.dmpFilesize
64KB
-
memory/112-149-0x000000001ADE0000-0x000000001ADF0000-memory.dmpFilesize
64KB
-
memory/112-148-0x000000001ADE0000-0x000000001ADF0000-memory.dmpFilesize
64KB
-
memory/112-150-0x00007FFE287B0000-0x00007FFE29271000-memory.dmpFilesize
10.8MB
-
memory/112-151-0x000000001ADE0000-0x000000001ADF0000-memory.dmpFilesize
64KB
-
memory/112-152-0x000000001B6A0000-0x000000001B849000-memory.dmpFilesize
1.7MB
-
memory/112-153-0x000000001ADE0000-0x000000001ADF0000-memory.dmpFilesize
64KB
-
memory/112-154-0x000000001ADE0000-0x000000001ADF0000-memory.dmpFilesize
64KB