Overview

overview

10

Static

static

3

moloch.exe

windows7-x64

10

moloch.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    25-06-2024 16:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    moloch.exe

  • Size

    262KB

  • MD5

    53e7b9e873404afdd22cdeba41b4e1c9

  • SHA1

    18b1a19f826e9d48d5776f6e3c279547f3ff517d

  • SHA256

    c34d0660da24b48480de58aaa394bd27f5a5b1ed9249d897ca4dde70312a87ec

  • SHA512

    ccc0af85ea847c45d11e213030e6b3224503c22fe70519049095b1d84cbf61e50c72ab370a03e456338127b52d462826248a6413706ab900afac16adf1deb9dd

  • SSDEEP

    3072:Bf1BDZ0kVB67Duw9AMc+7SCbnri3yYavcXri3tXpgI:B9X0G0S8W3Zavc7i3tXpJ

Score
10/10
makopdefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted and now have the "moloch" extension. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailbox: [email protected] or [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Signatures

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (8239) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\moloch.exe
    "C:\Users\Admin\AppData\Local\Temp\moloch.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Users\Admin\AppData\Local\Temp\moloch.exe
      "C:\Users\Admin\AppData\Local\Temp\moloch.exe"
      2⤵
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Users\Admin\AppData\Local\Temp\moloch.exe
        "C:\Users\Admin\AppData\Local\Temp\moloch.exe" n2572
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Users\Admin\AppData\Local\Temp\moloch.exe
          "C:\Users\Admin\AppData\Local\Temp\moloch.exe" n2572
          4⤵
            PID:1916
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2508
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:2636
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:1668
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2288
        • C:\Users\Admin\AppData\Local\Temp\moloch.exe
          "C:\Users\Admin\AppData\Local\Temp\moloch.exe" n2572
          3⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2196
          • C:\Users\Admin\AppData\Local\Temp\moloch.exe
            "C:\Users\Admin\AppData\Local\Temp\moloch.exe" n2572
            4⤵
              PID:1196
          • C:\Users\Admin\AppData\Local\Temp\moloch.exe
            "C:\Users\Admin\AppData\Local\Temp\moloch.exe" n2572
            3⤵
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:968
            • C:\Users\Admin\AppData\Local\Temp\moloch.exe
              "C:\Users\Admin\AppData\Local\Temp\moloch.exe" n2572
              4⤵
                PID:1656
            • C:\Users\Admin\AppData\Local\Temp\moloch.exe
              "C:\Users\Admin\AppData\Local\Temp\moloch.exe" n2572
              3⤵
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:980
              • C:\Users\Admin\AppData\Local\Temp\moloch.exe
                "C:\Users\Admin\AppData\Local\Temp\moloch.exe" n2572
                4⤵
                  PID:1680
              • C:\Users\Admin\AppData\Local\Temp\moloch.exe
                "C:\Users\Admin\AppData\Local\Temp\moloch.exe" n2572
                3⤵
                  PID:2272
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1720
            • C:\Windows\system32\wbengine.exe
              "C:\Windows\system32\wbengine.exe"
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2668
            • C:\Windows\System32\vdsldr.exe
              C:\Windows\System32\vdsldr.exe -Embedding
              1⤵
                PID:2456
              • C:\Windows\System32\vds.exe
                C:\Windows\System32\vds.exe
                1⤵
                  PID:2964

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Windows Management Instrumentation

                1
                T1047

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Defense Evasion

                Direct Volume Access

                1
                T1006

                Indicator Removal

                3
                T1070

                File Deletion

                3
                T1070.004

                Modify Registry

                2
                T1112

                Subvert Trust Controls

                1
                T1553

                Install Root Certificate

                1
                T1553.004

                Credential Access

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Inhibit System Recovery

                3
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                  Filesize

                  70KB

                  MD5

                  49aebf8cbd62d92ac215b2923fb1b9f5

                  SHA1

                  1723be06719828dda65ad804298d0431f6aff976

                  SHA256

                  b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                  SHA512

                  bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                  Filesize

                  342B

                  MD5

                  c4cf77f03f3b9a3e914927777a2863ab

                  SHA1

                  7a2b55cc322edee7ae36f9c4b24ad4ff4fb10d35

                  SHA256

                  144740babd5aacbacc7875307fc1d7c6f6a2cf0d92ff53e5383ebb5afb90f987

                  SHA512

                  23689dc6aa4f075a279ad46f13fb1712b21c05cdeff786486347ef02b5f833a177d1b270860e4366e5a9e5b8e8e02e42aedba258f161f2cff4db389dd8b82662

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\Cab7C91.tmp
                  Filesize

                  65KB

                  MD5

                  ac05d27423a85adc1622c714f2cb6184

                  SHA1

                  b0fe2b1abddb97837ea0195be70ab2ff14d43198

                  SHA256

                  c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                  SHA512

                  6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\Tar7DB1.tmp
                  Filesize

                  181KB

                  MD5

                  4ea6026cf93ec6338144661bf1202cd1

                  SHA1

                  a1dec9044f750ad887935a01430bf49322fbdcb7

                  SHA256

                  8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                  SHA512

                  6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\readme-warning.txt
                  Filesize

                  1KB

                  MD5

                  6b6bdda0b9ce4a9ee6bef7af0d910204

                  SHA1

                  5c5db80f0b4597d15ec016d02ac4d8c06af79a15

                  SHA256

                  0d7e86892a083dd154d7855c587a5425eb01b1af23dc399c1f08659694712e62

                  SHA512

                  8c6f5f1be7f926ff60773b8227b41221f5d4a3a376543c15e12c297f59bd9eb56256cb01fe9140036baad5e7874f94ce62aba51347295afd725caf8235172deb

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\827763568
                  Filesize

                  59KB

                  MD5

                  bc251d6a9f3408d4a2ff3add1d27ad3d

                  SHA1

                  99091c8e7a4ce7df879e157ddfba12d60095b1a9

                  SHA256

                  6e74f04c654aac5a0660ec5db3bfc2fa1ac1dc8a5f3fe683f36bcf8b049abd31

                  SHA512

                  23b91b23223432e345b38ceb5bcb0396f166cb079992491df275df1904dfa2c9e2f359a4c6bfba11de01d8df1ff777d0f9ed6921ada99ae44e38cb739747a995

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\827763568
                  Filesize

                  59KB

                  MD5

                  7f75d27f43fb0dcef2096b6af22f2471

                  SHA1

                  08ee426272028e5a7546e0b4a4f9636e09c212c8

                  SHA256

                  db70ab6a58e62fa6b9ee2d0b2b4fc25597c9463aee319c19bf364e2eeacf03bb

                  SHA512

                  8bfdba71d10cfa96dd961a36209d22591f90f4c9c9ce2a57ad33ee96040e0bf15d0ed498c77d0c026b709ff62698745efd84c68e8657765d44cad351a35b1b5b

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\827763568
                  Filesize

                  59KB

                  MD5

                  c1adbb3e0fdc8d22f7b186b89885bd07

                  SHA1

                  e453afb74124943b6c23d116a91f801cbb387e7d

                  SHA256

                  e2e28d98d90c326a6cc253a62da70646b373b8d194b11182ab14084624109d9f

                  SHA512

                  dbd1b12683d87007c10923c5d06db8c6b4fadc3b658c19de6473785fe9f81444f786a3fe6d5dbbcfc28d26075653bf4e627eefe15085483e95aabb5a1fdd48ca

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\827763568
                  Filesize

                  31KB

                  MD5

                  98010eeae5e657bb4d51b67d886318f8

                  SHA1

                  0dbd04eb38635fa17158fcfb972c7169f264a3e5

                  SHA256

                  ffa73b855a4f5157560daabcfeac884fbfb1de6df5b7a328360930dc1faa6bdd

                  SHA512

                  9ffac3918976bb25da581f4d71b2dd6426f294ec7c87d6d51b5817ad6a4c73e3b03767a6b1faa4489a1fa18fbb4e33781d984c679ba8c945484eb5ebed850c5f

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\827763568
                  Filesize

                  59KB

                  MD5

                  1e198272942edfb4bc571d620ad2872c

                  SHA1

                  264a4fa54cc743e903ffba856d1e1b3b9c17cff9

                  SHA256

                  02abe063b664e12ac4f4f086e5730b5e7bf081c9ed153870ace6bb7eb364a3be

                  SHA512

                  16ff14d9eb72f1842b8ada268fc091da95fd38c2de7f22e3dda6e2c23bc48759a87f07e52970aeb5375231e545fa4d652e7c9add0cdcb2fe21b98e97cf7faeae

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\nsi12A7.tmp\System.dll
                  Filesize

                  11KB

                  MD5

                  fccff8cb7a1067e23fd2e2b63971a8e1

                  SHA1

                  30e2a9e137c1223a78a0f7b0bf96a1c361976d91

                  SHA256

                  6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

                  SHA512

                  f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

                  Download Submit

                • memory/1196-17564-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/1196-17563-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/1196-17562-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/1656-17623-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/1656-17622-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/1656-17621-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/1916-6829-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/1916-5483-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/1916-6832-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/2572-10-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/2572-19-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/2572-9-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/2572-93-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/2572-17431-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/2572-8889-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/2572-7-0x0000000000400000-0x000000000041E000-memory.dmp

                  Filesize

                  120KB

                  Download