8a92e6115a329e47ab36222d86ea3f58f56b0a58b1010d2da280067346f38b21

General

Target
[email protected]
Size 2.4MB
Sample201109-al4vbbsafj
SHA256 8a92e6115a329e47ab36222d86ea3f58f56b0a58b1010d2da280067346f38b21
MD5 fe7149db72c952681473d15aec72671f
SHA1 93dd8ec8e11f263a5bca3739064bd44a7087f1eb
SHA512 9990622fb26fd22b11702b4994b8b900955552c050b6326e2f32d7befe38ad1e948508954bd70ff856b56c469c3426705b6c629f8f1e3c97c124bf029fdebed8
MD5 SHA1 SHA512

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\RedTools\\networker.exe\""	networker.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 1 IoCs

pid	Process
1588	networker.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	networker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	networker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	[email protected]

Deletes itself 1 IoCs

pid	Process
1588	networker.exe

Loads dropped DLL 2 IoCs

pid	Process
372	[email protected]
372	[email protected]

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	[email protected]
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	networker.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	networker.exe
File opened (read-only)	\??\F:	networker.exe
File opened (read-only)	\??\I:	networker.exe
File opened (read-only)	\??\P:	networker.exe
File opened (read-only)	\??\W:	networker.exe
File opened (read-only)	\??\A:	networker.exe
File opened (read-only)	\??\B:	networker.exe
File opened (read-only)	\??\H:	networker.exe
File opened (read-only)	\??\J:	networker.exe
File opened (read-only)	\??\K:	networker.exe
File opened (read-only)	\??\T:	networker.exe
File opened (read-only)	\??\Y:	networker.exe
File opened (read-only)	\??\G:	networker.exe
File opened (read-only)	\??\L:	networker.exe
File opened (read-only)	\??\M:	networker.exe
File opened (read-only)	\??\O:	networker.exe
File opened (read-only)	\??\R:	networker.exe
File opened (read-only)	\??\S:	networker.exe
File opened (read-only)	\??\Z:	networker.exe
File opened (read-only)	\??\N:	networker.exe
File opened (read-only)	\??\Q:	networker.exe
File opened (read-only)	\??\U:	networker.exe
File opened (read-only)	\??\V:	networker.exe
File opened (read-only)	\??\X:	networker.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
372	[email protected]
1588	networker.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1588	networker.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 1588	372	[email protected]	29
PID 372 wrote to memory of 1588	372	[email protected]	29
PID 372 wrote to memory of 1588	372	[email protected]	29
PID 372 wrote to memory of 1588	372	[email protected]	29
PID 1588 wrote to memory of 1416	1588	networker.exe	30
PID 1588 wrote to memory of 1416	1588	networker.exe	30
PID 1588 wrote to memory of 1416	1588	networker.exe	30
PID 1588 wrote to memory of 1416	1588	networker.exe	30

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:372
- C:\ProgramData\RedTools\networker.exe
  C:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\[email protected]" ensgJJ
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Deletes itself
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\secinit.exe
    C:\ProgramData\RedTools\networker.exe
    3⤵
    PID:1416