Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
16-09-2020 16:43
Static task
static1
Behavioral task
behavioral1
Sample
dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe
Resource
win7
General
-
Target
dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe
-
Size
356KB
-
MD5
0ada5f2eec1893ee695758b75ebe351b
-
SHA1
554bc863b128b83ca14f20e6b08028d8a12795a0
-
SHA256
dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597
-
SHA512
0aed5d83d07d651f62527aff20438090f143f86b98d053ad2af7a14b7166980078e8383910a4e38fabb8fa0bb60fcc23e56dbc7a5750be0b5827c1fa2bed780b
Malware Config
Extracted
buer
https://kackdelar.top/
Signatures
-
Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
Processes:
resource yara_rule behavioral2/memory/2056-6-0x0000000040000000-0x000000004000C000-memory.dmp buer behavioral2/memory/2056-7-0x0000000040002E38-mapping.dmp buer behavioral2/memory/2056-8-0x0000000040000000-0x000000004000C000-memory.dmp buer -
Drops startup file 1 IoCs
Processes:
dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
RegAsm.exedescription ioc process File opened (read-only) \??\A: RegAsm.exe File opened (read-only) \??\F: RegAsm.exe File opened (read-only) \??\M: RegAsm.exe File opened (read-only) \??\Q: RegAsm.exe File opened (read-only) \??\R: RegAsm.exe File opened (read-only) \??\Z: RegAsm.exe File opened (read-only) \??\B: RegAsm.exe File opened (read-only) \??\G: RegAsm.exe File opened (read-only) \??\L: RegAsm.exe File opened (read-only) \??\T: RegAsm.exe File opened (read-only) \??\X: RegAsm.exe File opened (read-only) \??\E: RegAsm.exe File opened (read-only) \??\H: RegAsm.exe File opened (read-only) \??\K: RegAsm.exe File opened (read-only) \??\N: RegAsm.exe File opened (read-only) \??\V: RegAsm.exe File opened (read-only) \??\W: RegAsm.exe File opened (read-only) \??\I: RegAsm.exe File opened (read-only) \??\J: RegAsm.exe File opened (read-only) \??\O: RegAsm.exe File opened (read-only) \??\P: RegAsm.exe File opened (read-only) \??\S: RegAsm.exe File opened (read-only) \??\U: RegAsm.exe File opened (read-only) \??\Y: RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exedescription pid process target process PID 3956 set thread context of 2056 3956 dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 4020 powershell.exe 4020 powershell.exe 4020 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exepid process 3956 dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4020 powershell.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exeRegAsm.exedescription pid process target process PID 3956 wrote to memory of 2056 3956 dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe RegAsm.exe PID 3956 wrote to memory of 2056 3956 dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe RegAsm.exe PID 3956 wrote to memory of 2056 3956 dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe RegAsm.exe PID 3956 wrote to memory of 2056 3956 dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe RegAsm.exe PID 2056 wrote to memory of 4020 2056 RegAsm.exe powershell.exe PID 2056 wrote to memory of 4020 2056 RegAsm.exe powershell.exe PID 2056 wrote to memory of 4020 2056 RegAsm.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe"C:\Users\Admin\AppData\Local\Temp\dee6a220c1a2a3a53361c929e903744b78a751b93c38405e629aae4c16d1e597.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\322b286117c0dcd2bde0}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4020