Analysis
- max time kernel
141s - max time network
144s - platform
windows10_x64 - resource
win10v200430 - submitted
18/05/2020, 15:42
Static task
static1
Behavioral task
behavioral1
Sample
newbuer.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
newbuer.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target newbuer.exe
- Size 111KB
- Sample200518-m7nvffm12n
- SHA256 9e746625abad522321067f546c40e8b26176ef5585bf3a45cb58ff758738f68c
- MD5 4df84f8de8a5526f119c26518b529757
- SHA1 42d281abeb10649bff097504f20e8fc2c8e85f5c
- SHA512 68cd6ce9eb7f01d7e6b2b2fff6dfdf981834168cb406a7d67df1f4c9d78b36b22689b03e408e3e68faf76d3bb4b0abd109024d4e2389258ea64a89f54e4a4b88
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\RedTools\\networker.exe\"" networker.exe - Executes dropped EXE 2 IoCs
pid Process 2828 networker.exe 3832 networker.exe - Deletes itself 1 IoCs
pid Process 3832 networker.exe - Loads dropped DLL 2 IoCs
pid Process 504 newbuer.exe 2828 networker.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: networker.exe File opened (read-only) \??\L: networker.exe File opened (read-only) \??\O: networker.exe File opened (read-only) \??\P: networker.exe File opened (read-only) \??\R: networker.exe File opened (read-only) \??\U: networker.exe File opened (read-only) \??\B: networker.exe File opened (read-only) \??\G: networker.exe File opened (read-only) \??\W: networker.exe File opened (read-only) \??\M: networker.exe File opened (read-only) \??\N: networker.exe File opened (read-only) \??\Q: networker.exe File opened (read-only) \??\T: networker.exe File opened (read-only) \??\Y: networker.exe File opened (read-only) \??\Z: networker.exe File opened (read-only) \??\A: networker.exe File opened (read-only) \??\I: networker.exe File opened (read-only) \??\J: networker.exe File opened (read-only) \??\V: networker.exe File opened (read-only) \??\X: networker.exe File opened (read-only) \??\F: networker.exe File opened (read-only) \??\H: networker.exe File opened (read-only) \??\E: networker.exe File opened (read-only) \??\S: networker.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 504 set thread context of 656 504 newbuer.exe 66 PID 2828 set thread context of 3832 2828 networker.exe 74 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 304 4088 WerFault.exe 75 - NSIS installer 6 IoCs
resource yara_rule behavioral2/files/0x000400000001ad54-1.dat nsis_installer_1 behavioral2/files/0x000400000001ad54-1.dat nsis_installer_2 behavioral2/files/0x000400000001ad54-2.dat nsis_installer_1 behavioral2/files/0x000400000001ad54-2.dat nsis_installer_2 behavioral2/files/0x000400000001ad54-5.dat nsis_installer_1 behavioral2/files/0x000400000001ad54-5.dat nsis_installer_2 - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 3832 networker.exe 3832 networker.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe 304 WerFault.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 504 newbuer.exe 2828 networker.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 304 WerFault.exe Token: SeBackupPrivilege 304 WerFault.exe Token: SeDebugPrivilege 304 WerFault.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 504 wrote to memory of 656 504 newbuer.exe 66 PID 504 wrote to memory of 656 504 newbuer.exe 66 PID 504 wrote to memory of 656 504 newbuer.exe 66 PID 504 wrote to memory of 656 504 newbuer.exe 66 PID 656 wrote to memory of 2828 656 newbuer.exe 73 PID 656 wrote to memory of 2828 656 newbuer.exe 73 PID 656 wrote to memory of 2828 656 newbuer.exe 73 PID 2828 wrote to memory of 3832 2828 networker.exe 74 PID 2828 wrote to memory of 3832 2828 networker.exe 74 PID 2828 wrote to memory of 3832 2828 networker.exe 74 PID 2828 wrote to memory of 3832 2828 networker.exe 74 PID 3832 wrote to memory of 4088 3832 networker.exe 75 PID 3832 wrote to memory of 4088 3832 networker.exe 75 PID 3832 wrote to memory of 4088 3832 networker.exe 75 PID 3832 wrote to memory of 4088 3832 networker.exe 75 PID 3832 wrote to memory of 4088 3832 networker.exe 75 PID 3832 wrote to memory of 4088 3832 networker.exe 75 PID 3832 wrote to memory of 4088 3832 networker.exe 75 PID 3832 wrote to memory of 4088 3832 networker.exe 75 PID 3832 wrote to memory of 4088 3832 networker.exe 75 PID 3832 wrote to memory of 4088 3832 networker.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\newbuer.exe"C:\Users\Admin\AppData\Local\Temp\newbuer.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Users\Admin\AppData\Local\Temp\newbuer.exe"C:\Users\Admin\AppData\Local\Temp\newbuer.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\ProgramData\RedTools\networker.exeC:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\newbuer.exe" ensgJJ3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\ProgramData\RedTools\networker.exeC:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\newbuer.exe" ensgJJ4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\RedTools\networker.exe5⤵PID:4088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 5446⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:304
-
-
-
-
-