Analysis
- max time kernel
140s - max time network
126s - platform
windows10_x64 - resource
win10 - submitted
06/07/2020, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe
- Size 38KB
- Sample200706-e9vg7tb8zn
- SHA256 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083
- MD5 d91043ee270758fbc29613e993cf17a6
- SHA1 bf3baf3e2d446f65b14d310e0e0a79d4002f9c03
- SHA512 1b8daad67e37e02835666acb1a815baccd235f955c95cf34bb28a9f4301eae32767919c1a473614da61ff7c0c0e646ac04317145228d6c57f02f3a0e55535000
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
buer
C2
-
https://66.228.45.248/
-
https://server-linode.nl/
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\de8a63018a2b5e297469\\gennt.exe\"" gennt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\de8a63018a2b5e297469\\gennt.exe\"" secinit.exe - Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral2/files/0x000300000001adb5-1.dat buer behavioral2/files/0x000300000001adb5-2.dat buer behavioral2/memory/3996-3-0x0000000000000000-mapping.dmp buer - Executes dropped EXE 1 IoCs
pid Process 3892 gennt.exe - Deletes itself 1 IoCs
pid Process 3892 gennt.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: secinit.exe File opened (read-only) \??\U: secinit.exe File opened (read-only) \??\Y: secinit.exe File opened (read-only) \??\H: secinit.exe File opened (read-only) \??\F: secinit.exe File opened (read-only) \??\G: secinit.exe File opened (read-only) \??\K: secinit.exe File opened (read-only) \??\O: secinit.exe File opened (read-only) \??\R: secinit.exe File opened (read-only) \??\E: secinit.exe File opened (read-only) \??\B: secinit.exe File opened (read-only) \??\J: secinit.exe File opened (read-only) \??\L: secinit.exe File opened (read-only) \??\P: secinit.exe File opened (read-only) \??\Q: secinit.exe File opened (read-only) \??\S: secinit.exe File opened (read-only) \??\W: secinit.exe File opened (read-only) \??\A: secinit.exe File opened (read-only) \??\Z: secinit.exe File opened (read-only) \??\X: secinit.exe File opened (read-only) \??\M: secinit.exe File opened (read-only) \??\T: secinit.exe File opened (read-only) \??\V: secinit.exe File opened (read-only) \??\I: secinit.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3996 secinit.exe 3996 secinit.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3148 wrote to memory of 3892 3148 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe 67 PID 3148 wrote to memory of 3892 3148 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe 67 PID 3148 wrote to memory of 3892 3148 070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe 67 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3892 wrote to memory of 3996 3892 gennt.exe 68 PID 3996 wrote to memory of 1596 3996 secinit.exe 75 PID 3996 wrote to memory of 1596 3996 secinit.exe 75 PID 3996 wrote to memory of 1596 3996 secinit.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe"C:\Users\Admin\AppData\Local\Temp\070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\ProgramData\de8a63018a2b5e297469\gennt.exeC:\ProgramData\de8a63018a2b5e297469\gennt.exe "C:\Users\Admin\AppData\Local\Temp\070d785aab37f9ac742f0c5ad255be4d46147ae9917960058fe5846a2e2e1083.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\de8a63018a2b5e297469\gennt.exe3⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" powershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\de8a63018a2b5e297469}"4⤵PID:1596
-
-
-