Analysis
-
max time kernel
601s -
max time network
610s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 21:02
Static task
static1
Behavioral task
behavioral1
Sample
a94591ab207cc7cfb86586e50fa23c74b660bbdeab183360671973f2c63c2fcd.exe
Resource
win7
Behavioral task
behavioral2
Sample
a94591ab207cc7cfb86586e50fa23c74b660bbdeab183360671973f2c63c2fcd.exe
Resource
win7v200430
General
-
Target
a94591ab207cc7cfb86586e50fa23c74b660bbdeab183360671973f2c63c2fcd.exe
-
Size
259KB
-
MD5
343a2579cafed501bcad9ad2ebd010e6
-
SHA1
2462cbff6243ba3eb179aa4f799d1a6fc41dac18
-
SHA256
a94591ab207cc7cfb86586e50fa23c74b660bbdeab183360671973f2c63c2fcd
-
SHA512
7adeb12f79dd63d91c5cc2864fa15ed48605e122a4a968993f95e986d84bf33baf4c02344ce957e25af2ff5270fab6af211b10947f47a6127b445ce8b5474e48
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exevnmpbciq.exedescription pid process target process PID 1208 wrote to memory of 1584 1208 cmd.exe vnmpbciq.exe PID 1208 wrote to memory of 1584 1208 cmd.exe vnmpbciq.exe PID 1208 wrote to memory of 1584 1208 cmd.exe vnmpbciq.exe PID 2028 wrote to memory of 1004 2028 vnmpbciq.exe WerFault.exe PID 2028 wrote to memory of 1004 2028 vnmpbciq.exe WerFault.exe PID 2028 wrote to memory of 1004 2028 vnmpbciq.exe WerFault.exe -
Executes dropped EXE 2 IoCs
Processes:
vnmpbciq.exevnmpbciq.exepid process 1584 vnmpbciq.exe 2028 vnmpbciq.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1004 2028 WerFault.exe vnmpbciq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1004 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe -
BazarBackdoor
Stealthy backdoor targetting corporate networks, believed to be developed by Trickbot's authors.
-
Loads dropped DLL 5 IoCs
Processes:
cmd.exeWerFault.exepid process 1208 cmd.exe 848 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a94591ab207cc7cfb86586e50fa23c74b660bbdeab183360671973f2c63c2fcd.exe"C:\Users\Admin\AppData\Local\Temp\a94591ab207cc7cfb86586e50fa23c74b660bbdeab183360671973f2c63c2fcd.exe"1⤵
-
C:\Windows\system32\cmd.execmd.exe / c "start "" /b "cmd.exe" /c "copy /y "C:\Users\Admin\AppData\Local\Temp\a94591ab207cc7cfb86586e50fa23c74b660bbdeab183360671973f2c63c2fcd.exe" "C:\Users\Admin\AppData\Local\Temp\vnmpbciq.exe"&&start "" /b "C:\Users\Admin\AppData\Local\Temp\vnmpbciq.exe" -z {317BF45D-B95F-40F5-BB5B-6CAABDFEE7B8}&&exit 0""1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\vnmpbciq.exe"C:\Users\Admin\AppData\Local\Temp\vnmpbciq.exe" -z {317BF45D-B95F-40F5-BB5B-6CAABDFEE7B8}2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\vnmpbciq.exe"C:\Users\Admin\AppData\Local\Temp\vnmpbciq.exe" -r {D8B04761-8923-4899-B730-34B9E5B14230}1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2028 -s 3322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\Local\Temp\vnmpbciq.exe
-
C:\Users\Admin\AppData\Local\Temp\vnmpbciq.exe
-
C:\Users\Admin\AppData\Local\Temp\vnmpbciq.exe
-
\Users\Admin\AppData\Local\Temp\vnmpbciq.exe
-
\Users\Admin\AppData\Local\Temp\vnmpbciq.exe
-
\Users\Admin\AppData\Local\Temp\vnmpbciq.exe
-
\Users\Admin\AppData\Local\Temp\vnmpbciq.exe
-
\Users\Admin\AppData\Local\Temp\vnmpbciq.exe
-
memory/824-0-0x00000000000F0000-0x0000000000111000-memory.dmpFilesize
132KB
-
memory/1004-12-0x0000000000000000-mapping.dmp
-
memory/1004-13-0x0000000001FE0000-0x0000000001FF1000-memory.dmpFilesize
68KB
-
memory/1004-17-0x0000000002860000-0x0000000002871000-memory.dmpFilesize
68KB
-
memory/1584-3-0x0000000000000000-mapping.dmp
-
memory/1584-2-0x0000000000000000-mapping.dmp