Overview
overview
10Static
static
10001e9becdd...93.exe
windows10-2004-x64
71a1cf2a2f6...31.exe
windows10-2004-x64
72eac3720bc...61.exe
windows10-2004-x64
1320e3af17b...4c.exe
windows10-2004-x64
333bcab7033...70.exe
windows10-2004-x64
647a52afd63...2e.exe
windows10-2004-x64
104b24d27301...69.exe
windows10-2004-x64
74c481d251f...5a.exe
windows10-2004-x64
14c9ab76300...dd.exe
windows10-2004-x64
650a04b093c...95.dll
windows10-2004-x64
65266183553...2f.dll
windows10-2004-x64
8547798defb...6e.exe
windows10-2004-x64
105fb2242c04...96.exe
windows10-2004-x64
163a0bf6385...12.exe
windows10-2004-x64
106a08b51e02...68.exe
windows10-2004-x64
5803d827a2c...53.exe
windows10-2004-x64
785523c6377...c3.exe
windows10-2004-x64
38ab3db7349...03.exe
windows10-2004-x64
99b87457fe8...f0.exe
windows10-2004-x64
8a3c7b0df18...cc.exe
windows10-2004-x64
1ab4fa067af...38.exe
windows10-2004-x64
10b1c5c3ca41...7d.exe
windows10-2004-x64
3ca561f9403...c5.exe
windows10-2004-x64
7d278eb3d6c...8f.exe
windows10-2004-x64
6d3e04348f4...91.exe
windows10-2004-x64
10d7e876a714...c9.exe
windows10-2004-x64
7dd8bf2763c...38.exe
windows10-2004-x64
dd9ca1355f...9a.exe
windows10-2004-x64
7dd9d07d1f5...27.exe
windows10-2004-x64
10ef3c260fed...49.exe
windows10-2004-x64
10f40df86d68...df.exe
windows10-2004-x64
10fb861230c0...01.exe
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2023 21:16
Behavioral task
behavioral1
Sample
001e9becdd7d9887c6fbe487073ad3dc068124a5300f4128d9ed32db4f63f793.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
2eac3720bcfb4550e3093f053880b373068360bc8583f2aee059905bcad29c61.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral4
Sample
320e3af17bb8787283fe0c4af9d3a778c191d8374f19c0bc6b6ee2f22363094c.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
33bcab70334406fb3331b4b3fffbf8c51df52d93efb5d673d865b7a7496b1570.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral6
Sample
47a52afd63406238b1b5ce59a7cb282685629b14169405015b0cef20fbe4f62e.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
4b24d273019579ba3c1e0ad261954c0941d114aab802fa2d1fcb14dab9f3e869.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
4c481d251f29295af1af599374ea93f9fc24b6139fbb02ec115bec9f4e7bc25a.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral10
Sample
50a04b093c8f05481eb672ebec0537f61e233071798d1f3b939e17e333b51795.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
5266183553addd392a0968ea9e835c00e55a27468829ab65832cda37508c8e2f.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
547798defb6d577ec9f13b00fb1be293f903aaa974ddc049be16d6437aeec86e.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
5fb2242c04ce18830b84de73c4f0fc4e9c8a5e6877a14f414fcbfaa5a3948896.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
63a0bf6385356dd0297449bdca2a2f171846315505800e81a4c0285f09c87312.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
6a08b51e02a7b510972907c326041222ff4632ba53b89573fca7e80b59c4e168.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
803d827a2cd764008783e691ce132ef853dbfa77017e5d2eeae47ceb3ca50f53.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
85523c6377c27e22068a2ef347997a295981b91e103b3cf3387ed80aa0b010c3.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral18
Sample
8ab3db7349f38d6463a3c6a7155ab297f18d92262a098064ea2472cecc7e3103.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
9b87457fe85670e2c059cedaa560a8a31027e96fe18b2b6a7fe610f38423b2f0.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral20
Sample
a3c7b0df189bdd47c7e113ff3b664f26b0bcd6f4f878186e882ea199e15c28cc.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral22
Sample
b1c5c3ca41c322b47a5feb62ebb0e5daa3c1c682aa1dedb98fd3b7dff3eca57d.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
ca561f9403ab4be76ca66646df1a3da826fa2cc1972dd005ad23861abb317cc5.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral24
Sample
d278eb3d6cc29c6de4b086aaa6214412d62fe2bb850c0ead63a403c3a24b2c8f.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral26
Sample
d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral27
Sample
dd8bf2763ce09cbeb21cdbf802b9f7475c7998e459714150fae07ffcd027bb38.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral28
Sample
dd9ca1355ff3ddd883f9d2d0e6df9b7a8ebff650003a616c533b30554cee2a9a.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral29
Sample
dd9d07d1f5bb4facb1b4e412ce9e52a5ca9a689f2f78c34bacf63af19f7ce127.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral30
Sample
ef3c260fed0a71f0e679261aeb242133899f9ff03d68b5f95711a66ef919e549.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral31
Sample
f40df86d68d075c73e1be8ed5b3201f0e55a9eccf662258a219acee35df398df.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral32
Sample
fb861230c088dd68f1a6c782e9ad0b44a1831ccc29c0516635cc4b3de2a91a01.exe
Resource
win10v2004-20231023-en
General
-
Target
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe
-
Size
73KB
-
MD5
0b86474cc124beeec871e7ca53b333f5
-
SHA1
43e4c87efaf509a17bc4f517cb9133f6cd5297ea
-
SHA256
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd
-
SHA512
71274745d3ff6b3e26571ee4dacad7084f04be705afd7196de697fd985ffa289d7e87b962d707130bde0af9eb9784ad6fd005f308843de8feedcceae78d0f58b
-
SSDEEP
1536:n55u555555555pmgSeGDjtQhnwmmB0ybMqqU+2bbbAV2/S2mr3IdE8mne0Avu5rJ:DMSjOnrmBTMqqDL2/mr3IdE8we0Avu5h
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bkpgbfaokse = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe" 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exedescription ioc process File opened (read-only) \??\Z: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\G: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\J: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\N: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\P: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\S: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\W: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\A: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\K: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\Q: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\R: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\X: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\Y: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\H: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\I: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\L: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\O: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\V: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\B: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\E: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\M: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\T: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe File opened (read-only) \??\U: 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exepid process 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exedescription pid process target process PID 2796 wrote to memory of 2608 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2608 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2608 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4996 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4996 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4996 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4464 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4464 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4464 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2472 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2472 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2472 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2164 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2164 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2164 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4056 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4056 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4056 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2792 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2792 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2792 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4860 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4860 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 4860 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2132 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2132 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 2132 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 3132 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 3132 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 3132 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 3500 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 3500 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe PID 2796 wrote to memory of 3500 2796 4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe"C:\Users\Admin\AppData\Local\Temp\4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru2⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup emsisoft.bit dns1.soprodns.ru2⤵