72b68249a4e34e5d396bdd07e3d0d71d73d11a967173d8ce344d2cabf22f8fa9

General

Target
1 (4).exe
Size 4.0MB
Sample201005-g7knetrvle
SHA256 72b68249a4e34e5d396bdd07e3d0d71d73d11a967173d8ce344d2cabf22f8fa9
MD5 8a0c2d288de53b7d69078961cf14b730
SHA1 83315153a6d0acee111683251d6465b68f30590e
SHA512 e10f42e4e250a6e0bb1cd1ab8d095e0236eab75cacc9574367c47ccb20f5cc38857adbcac18b976976eb283a8f1dd7c69eab39cbd4c3a4dd0743949334faa54d
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
3776	rgzgxpey.exe
1828	rgzgxpey.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	1 (4).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	1 (4).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	1 (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	1 (4).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	1 (4).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	1 (4).exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 3860	4036	1 (4).exe	75
PID 4036 wrote to memory of 3860	4036	1 (4).exe	75
PID 4036 wrote to memory of 3860	4036	1 (4).exe	75
PID 4036 wrote to memory of 3776	4036	1 (4).exe	76
PID 4036 wrote to memory of 3776	4036	1 (4).exe	76
PID 4036 wrote to memory of 3776	4036	1 (4).exe	76
PID 4036 wrote to memory of 1912	4036	1 (4).exe	77
PID 4036 wrote to memory of 1912	4036	1 (4).exe	77
PID 4036 wrote to memory of 1912	4036	1 (4).exe	77
PID 3776 wrote to memory of 1828	3776	rgzgxpey.exe	79
PID 3776 wrote to memory of 1828	3776	rgzgxpey.exe	79
PID 3776 wrote to memory of 1828	3776	rgzgxpey.exe	79

C:\Users\Admin\AppData\Local\Temp\1 (4).exe
"C:\Users\Admin\AppData\Local\Temp\1 (4).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Local\Temp\1 (4).exe
  "C:\Users\Admin\AppData\Local\Temp\1 (4).exe" /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Users\Admin\AppData\Roaming\Microsoft\Ptidielaof\rgzgxpey.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Ptidielaof\rgzgxpey.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Users\Admin\AppData\Roaming\Microsoft\Ptidielaof\rgzgxpey.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Ptidielaof\rgzgxpey.exe /C
    3⤵
    - Executes dropped EXE
    PID:1828
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ceasvwbzp /tr "\"C:\Users\Admin\AppData\Local\Temp\1 (4).exe\" /I ceasvwbzp" /SC ONCE /Z /ST 10:11 /ET 10:23
  2⤵
  - Creates scheduled task(s)
  PID:1912