Analysis
- max time kernel
138s - max time network
137s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:40
Static task
static1
windows7_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
General
- Target [email protected]
- Size 2.4MB
- Sample201109-al4vbbsafj
- SHA256 8a92e6115a329e47ab36222d86ea3f58f56b0a58b1010d2da280067346f38b21
- MD5 fe7149db72c952681473d15aec72671f
- SHA1 93dd8ec8e11f263a5bca3739064bd44a7087f1eb
- SHA512 9990622fb26fd22b11702b4994b8b900955552c050b6326e2f32d7befe38ad1e948508954bd70ff856b56c469c3426705b6c629f8f1e3c97c124bf029fdebed8
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\RedTools\\networker.exe\"" networker.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Executes dropped EXE 1 IoCs
pid Process 4024 networker.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion networker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion networker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion [email protected] Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion [email protected] - Deletes itself 1 IoCs
pid Process 4024 networker.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA [email protected] Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA networker.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: networker.exe File opened (read-only) \??\J: networker.exe File opened (read-only) \??\N: networker.exe File opened (read-only) \??\S: networker.exe File opened (read-only) \??\V: networker.exe File opened (read-only) \??\W: networker.exe File opened (read-only) \??\E: networker.exe File opened (read-only) \??\P: networker.exe File opened (read-only) \??\Q: networker.exe File opened (read-only) \??\Y: networker.exe File opened (read-only) \??\Z: networker.exe File opened (read-only) \??\A: networker.exe File opened (read-only) \??\F: networker.exe File opened (read-only) \??\I: networker.exe File opened (read-only) \??\K: networker.exe File opened (read-only) \??\O: networker.exe File opened (read-only) \??\R: networker.exe File opened (read-only) \??\U: networker.exe File opened (read-only) \??\G: networker.exe File opened (read-only) \??\H: networker.exe File opened (read-only) \??\L: networker.exe File opened (read-only) \??\M: networker.exe File opened (read-only) \??\T: networker.exe File opened (read-only) \??\X: networker.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 636 [email protected] 4024 networker.exe - Program crash 1 IoCs
pid pid_target Process procid_target 784 188 WerFault.exe 79 - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 4024 networker.exe 4024 networker.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe 784 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 784 WerFault.exe Token: SeBackupPrivilege 784 WerFault.exe Token: SeDebugPrivilege 784 WerFault.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 636 wrote to memory of 4024 636 [email protected] 78 PID 636 wrote to memory of 4024 636 [email protected] 78 PID 636 wrote to memory of 4024 636 [email protected] 78 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79 PID 4024 wrote to memory of 188 4024 networker.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:636 -
C:\ProgramData\RedTools\networker.exeC:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\[email protected]" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks BIOS information in registry
- Deletes itself
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\RedTools\networker.exe3⤵PID:188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 188 -s 3364⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784
-
-
-