Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
06-07-2020 07:30
Static task
static1
Behavioral task
behavioral1
Sample
070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe
Resource
win10
General
-
Target
070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe
-
Size
38KB
-
MD5
d91043ee270758fbc29613e993cf17a6
-
SHA1
bf3baf3e2d446f65b14d310e0e0a79d4002f9c03
-
SHA256
070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083
-
SHA512
1b8daad67e37e02835666acb1a815baccd235f955c95cf34bb28a9f4301eae32767919c1a473614da61ff7c0c0e646ac04317145228d6c57f02f3a0e55535000
Malware Config
Extracted
buer
https://66.228.45.248/
https://server-linode.nl/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\d27b15bf5fed4179aa6c\\gennt.exe\"" gennt.exe -
Buer Loader 4 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral1/files/0x000400000001319e-0.dat buer behavioral1/files/0x000400000001319e-1.dat buer behavioral1/files/0x000400000001319e-3.dat buer behavioral1/files/0x000400000001319e-5.dat buer -
Executes dropped EXE 1 IoCs
pid Process 1828 gennt.exe -
Deletes itself 1 IoCs
pid Process 1828 gennt.exe -
Loads dropped DLL 2 IoCs
pid Process 1528 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe 1528 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: gennt.exe File opened (read-only) \??\X: gennt.exe File opened (read-only) \??\B: gennt.exe File opened (read-only) \??\E: gennt.exe File opened (read-only) \??\Q: gennt.exe File opened (read-only) \??\T: gennt.exe File opened (read-only) \??\R: gennt.exe File opened (read-only) \??\U: gennt.exe File opened (read-only) \??\J: gennt.exe File opened (read-only) \??\K: gennt.exe File opened (read-only) \??\N: gennt.exe File opened (read-only) \??\O: gennt.exe File opened (read-only) \??\Z: gennt.exe File opened (read-only) \??\A: gennt.exe File opened (read-only) \??\G: gennt.exe File opened (read-only) \??\H: gennt.exe File opened (read-only) \??\W: gennt.exe File opened (read-only) \??\P: gennt.exe File opened (read-only) \??\S: gennt.exe File opened (read-only) \??\Y: gennt.exe File opened (read-only) \??\F: gennt.exe File opened (read-only) \??\I: gennt.exe File opened (read-only) \??\L: gennt.exe File opened (read-only) \??\M: gennt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1828 gennt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1528 wrote to memory of 1828 1528 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe 26 PID 1528 wrote to memory of 1828 1528 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe 26 PID 1528 wrote to memory of 1828 1528 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe 26 PID 1528 wrote to memory of 1828 1528 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe 26 PID 1828 wrote to memory of 1836 1828 gennt.exe 27 PID 1828 wrote to memory of 1836 1828 gennt.exe 27 PID 1828 wrote to memory of 1836 1828 gennt.exe 27 PID 1828 wrote to memory of 1836 1828 gennt.exe 27 PID 1828 wrote to memory of 1868 1828 gennt.exe 28 PID 1828 wrote to memory of 1868 1828 gennt.exe 28 PID 1828 wrote to memory of 1868 1828 gennt.exe 28 PID 1828 wrote to memory of 1868 1828 gennt.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe"C:\Users\Admin\AppData\Local\Temp\070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\ProgramData\d27b15bf5fed4179aa6c\gennt.exeC:\ProgramData\d27b15bf5fed4179aa6c\gennt.exe "C:\Users\Admin\AppData\Local\Temp\070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\d27b15bf5fed4179aa6c\gennt.exe3⤵PID:1836
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\d27b15bf5fed4179aa6c}"3⤵PID:1868
-
-