Analysis
- max time kernel
143s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 12:43
Static task
static1
Behavioral task
behavioral1
Sample
85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe
- Size 35KB
- Sample201109-k5prgaf7c2
- SHA256 85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124
- MD5 6f14c56f141d8eb8ccc58f6e3f341426
- SHA1 70d9bc4ded0b7546ad7ee6d4873a5f5f58bc04e7
- SHA512 c91fb3355543beb3040ee4ef1287f1725f834279cc58786fe37fe0859612198b69e971c9910d379254018b51d0058749ae6199e28aec15d9ef5ce76fd3bbe5bd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
buer
C2
-
https://gstatiknetiplist.cc/
-
https://gstatiknetiplist.com/
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\responder.exe\"" responder.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\responder.exe\"" secinit.exe - Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral2/files/0x000300000001a2df-1.dat buer behavioral2/files/0x000300000001a2df-2.dat buer behavioral2/memory/580-4-0x0000000000000000-mapping.dmp buer - Executes dropped EXE 1 IoCs
pid Process 732 responder.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: secinit.exe File opened (read-only) \??\G: secinit.exe File opened (read-only) \??\J: secinit.exe File opened (read-only) \??\N: secinit.exe File opened (read-only) \??\Q: secinit.exe File opened (read-only) \??\W: secinit.exe File opened (read-only) \??\X: secinit.exe File opened (read-only) \??\Y: secinit.exe File opened (read-only) \??\A: secinit.exe File opened (read-only) \??\E: secinit.exe File opened (read-only) \??\H: secinit.exe File opened (read-only) \??\K: secinit.exe File opened (read-only) \??\M: secinit.exe File opened (read-only) \??\O: secinit.exe File opened (read-only) \??\P: secinit.exe File opened (read-only) \??\R: secinit.exe File opened (read-only) \??\S: secinit.exe File opened (read-only) \??\T: secinit.exe File opened (read-only) \??\U: secinit.exe File opened (read-only) \??\V: secinit.exe File opened (read-only) \??\B: secinit.exe File opened (read-only) \??\I: secinit.exe File opened (read-only) \??\L: secinit.exe File opened (read-only) \??\Z: secinit.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 580 secinit.exe 580 secinit.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1036 wrote to memory of 732 1036 85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe 79 PID 1036 wrote to memory of 732 1036 85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe 79 PID 1036 wrote to memory of 732 1036 85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe 79 PID 732 wrote to memory of 580 732 responder.exe 80 PID 732 wrote to memory of 580 732 responder.exe 80 PID 732 wrote to memory of 580 732 responder.exe 80 PID 732 wrote to memory of 580 732 responder.exe 80 PID 732 wrote to memory of 580 732 responder.exe 80 PID 732 wrote to memory of 580 732 responder.exe 80 PID 732 wrote to memory of 580 732 responder.exe 80 PID 732 wrote to memory of 580 732 responder.exe 80 PID 732 wrote to memory of 580 732 responder.exe 80 PID 732 wrote to memory of 580 732 responder.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe"C:\Users\Admin\AppData\Local\Temp\85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\ProgramData\ErrorResponder\responder.exeC:\ProgramData\ErrorResponder\responder.exe "C:\Users\Admin\AppData\Local\Temp\85da0e15d51bbb0ff7efe69d6cf0e1858efaa0ba1993222868ee71d3d755e124.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\ErrorResponder\responder.exe3⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:580
-
-