Analysis
-
max time kernel
91s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2023 21:28
Static task
static1
Behavioral task
behavioral1
Sample
HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe
Resource
win10v2004-20231020-en
General
-
Target
HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe
-
Size
3.0MB
-
MD5
0e460c38a2cb05f01053a570686d6c56
-
SHA1
b03c044dc6d123c97121ce0b2730b6de3abf4d21
-
SHA256
09a70564723d4a33bb06b1ad49c656f3b4ff32bc50af5fdd08bf3f1f70735bdb
-
SHA512
9bff52b49441e26ef026f3e4989ed70aa05de25160ceb8ea1f3ab0601387b78d5d60604cc8ec8a916c9d022509fbc299816c7b7b3394bbc4fc800514a4d26904
-
SSDEEP
49152:NQnXDFBU2iIBb0xY/6sUYY8e7o0goV6P:yzXbFZCBvr79goV
Malware Config
Extracted
bitrat
1.38
adata.hopto.org:8808
-
communication_password
b4a7954d05674c9418110a730f2224aa
-
install_dir
Microsoft Edge
-
install_file
Edge.exe
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe -
Executes dropped EXE 2 IoCs
Processes:
0c9htcgBsGMw2tTz.exe6LuQ6I5kzSaMf7pl.exepid process 3628 0c9htcgBsGMw2tTz.exe 3104 6LuQ6I5kzSaMf7pl.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\0c9htcgBsGMw2tTz.exe upx C:\Users\Admin\AppData\Local\Temp\0c9htcgBsGMw2tTz.exe upx C:\Users\Admin\AppData\Local\Temp\0c9htcgBsGMw2tTz.exe upx behavioral2/memory/3628-10-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3628-27-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
0c9htcgBsGMw2tTz.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Edge = "C:\\Users\\Admin\\AppData\\Local\\Microsoft Edge\\Edge.exe" 0c9htcgBsGMw2tTz.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Edge = "C:\\Users\\Admin\\AppData\\Local\\Microsoft Edge\\Edge.exe贀" 0c9htcgBsGMw2tTz.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Edge = "C:\\Users\\Admin\\AppData\\Local\\Microsoft Edge\\Edge.exe耀" 0c9htcgBsGMw2tTz.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
0c9htcgBsGMw2tTz.exepid process 3628 0c9htcgBsGMw2tTz.exe 3628 0c9htcgBsGMw2tTz.exe 3628 0c9htcgBsGMw2tTz.exe 3628 0c9htcgBsGMw2tTz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 2 IoCs
Processes:
0c9htcgBsGMw2tTz.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local:20-10-2023 0c9htcgBsGMw2tTz.exe File created C:\Users\Admin\AppData\Local:20-10-2023 0c9htcgBsGMw2tTz.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0c9htcgBsGMw2tTz.exedescription pid process Token: SeShutdownPrivilege 3628 0c9htcgBsGMw2tTz.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
6LuQ6I5kzSaMf7pl.exepid process 3104 6LuQ6I5kzSaMf7pl.exe 3104 6LuQ6I5kzSaMf7pl.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0c9htcgBsGMw2tTz.exepid process 3628 0c9htcgBsGMw2tTz.exe 3628 0c9htcgBsGMw2tTz.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exedescription pid process target process PID 3020 wrote to memory of 3628 3020 HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe 0c9htcgBsGMw2tTz.exe PID 3020 wrote to memory of 3628 3020 HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe 0c9htcgBsGMw2tTz.exe PID 3020 wrote to memory of 3628 3020 HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe 0c9htcgBsGMw2tTz.exe PID 3020 wrote to memory of 3104 3020 HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe 6LuQ6I5kzSaMf7pl.exe PID 3020 wrote to memory of 3104 3020 HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe 6LuQ6I5kzSaMf7pl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe"C:\Users\Admin\AppData\Local\Temp\HardCut Limiter Petrol EnginesV1.7_Pop&Bang.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\0c9htcgBsGMw2tTz.exe"C:\Users\Admin\AppData\Local\Temp\0c9htcgBsGMw2tTz.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\6LuQ6I5kzSaMf7pl.exe"C:\Users\Admin\AppData\Local\Temp\6LuQ6I5kzSaMf7pl.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0c9htcgBsGMw2tTz.exeFilesize
1.4MB
MD5013252bf1ed61c20689def98aaa2a8ec
SHA13986aabf2279088edba0d6d01ac1ad9dd71e86df
SHA256c50b57d0f4e9a1d6ba5ef93dbe75782e1661fd5f1b0c457094412ef74ff6552d
SHA512838f84b4789ff23194645ac2e8d422f685d31d028dd9f864ca9afb24cf8b326fbecd34fd5a12bd92a430a3c1bf1385374924482a9ddd6c82ee95a72f0d493ac1
-
C:\Users\Admin\AppData\Local\Temp\0c9htcgBsGMw2tTz.exeFilesize
1.4MB
MD5013252bf1ed61c20689def98aaa2a8ec
SHA13986aabf2279088edba0d6d01ac1ad9dd71e86df
SHA256c50b57d0f4e9a1d6ba5ef93dbe75782e1661fd5f1b0c457094412ef74ff6552d
SHA512838f84b4789ff23194645ac2e8d422f685d31d028dd9f864ca9afb24cf8b326fbecd34fd5a12bd92a430a3c1bf1385374924482a9ddd6c82ee95a72f0d493ac1
-
C:\Users\Admin\AppData\Local\Temp\0c9htcgBsGMw2tTz.exeFilesize
1.4MB
MD5013252bf1ed61c20689def98aaa2a8ec
SHA13986aabf2279088edba0d6d01ac1ad9dd71e86df
SHA256c50b57d0f4e9a1d6ba5ef93dbe75782e1661fd5f1b0c457094412ef74ff6552d
SHA512838f84b4789ff23194645ac2e8d422f685d31d028dd9f864ca9afb24cf8b326fbecd34fd5a12bd92a430a3c1bf1385374924482a9ddd6c82ee95a72f0d493ac1
-
C:\Users\Admin\AppData\Local\Temp\6LuQ6I5kzSaMf7pl.exeFilesize
1.4MB
MD5862bccf337437d8cdef98b57cbe4f6da
SHA1224992961b45c0f81aa69fb684793e070a01344c
SHA256c12640ed63fc7f6a5c685015ea2359649875e363b106847dd3b4a6d4ba602611
SHA512e85f5f629c23b6573aa350d02fdb032fd5e41963762fd0e28733ed4a236cf59c59190a4b31b7066dc12fe6e516c2394f402465d764276c707e0bf05f58ece898
-
C:\Users\Admin\AppData\Local\Temp\6LuQ6I5kzSaMf7pl.exeFilesize
1.4MB
MD5862bccf337437d8cdef98b57cbe4f6da
SHA1224992961b45c0f81aa69fb684793e070a01344c
SHA256c12640ed63fc7f6a5c685015ea2359649875e363b106847dd3b4a6d4ba602611
SHA512e85f5f629c23b6573aa350d02fdb032fd5e41963762fd0e28733ed4a236cf59c59190a4b31b7066dc12fe6e516c2394f402465d764276c707e0bf05f58ece898
-
C:\Users\Admin\AppData\Local\Temp\6LuQ6I5kzSaMf7pl.exeFilesize
1.4MB
MD5862bccf337437d8cdef98b57cbe4f6da
SHA1224992961b45c0f81aa69fb684793e070a01344c
SHA256c12640ed63fc7f6a5c685015ea2359649875e363b106847dd3b4a6d4ba602611
SHA512e85f5f629c23b6573aa350d02fdb032fd5e41963762fd0e28733ed4a236cf59c59190a4b31b7066dc12fe6e516c2394f402465d764276c707e0bf05f58ece898
-
memory/3104-32-0x000002BE6E290000-0x000002BE6E2A0000-memory.dmpFilesize
64KB
-
memory/3104-30-0x000002BE6E290000-0x000002BE6E2A0000-memory.dmpFilesize
64KB
-
memory/3104-22-0x00007FFF7E130000-0x00007FFF7EBF1000-memory.dmpFilesize
10.8MB
-
memory/3104-23-0x000002BE6E290000-0x000002BE6E2A0000-memory.dmpFilesize
64KB
-
memory/3104-24-0x000002BE6E290000-0x000002BE6E2A0000-memory.dmpFilesize
64KB
-
memory/3104-50-0x00007FFF7E130000-0x00007FFF7EBF1000-memory.dmpFilesize
10.8MB
-
memory/3104-21-0x000002BE6BAB0000-0x000002BE6BC16000-memory.dmpFilesize
1.4MB
-
memory/3104-49-0x000002BE6E290000-0x000002BE6E2A0000-memory.dmpFilesize
64KB
-
memory/3104-31-0x000002BE6E290000-0x000002BE6E2A0000-memory.dmpFilesize
64KB
-
memory/3104-29-0x00007FFF7E130000-0x00007FFF7EBF1000-memory.dmpFilesize
10.8MB
-
memory/3628-26-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/3628-28-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/3628-10-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3628-33-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/3628-34-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/3628-35-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/3628-47-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/3628-27-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3628-25-0x0000000074C50000-0x0000000074C89000-memory.dmpFilesize
228KB
-
memory/3628-51-0x0000000074BC0000-0x0000000074BF9000-memory.dmpFilesize
228KB
-
memory/3628-52-0x0000000074C50000-0x0000000074C89000-memory.dmpFilesize
228KB