Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
dbdea804ef4eb5df7ae106edb4b755cb.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dbdea804ef4eb5df7ae106edb4b755cb.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target dbdea804ef4eb5df7ae106edb4b755cb.exe
- Size 169KB
- Sample201109-kf77mjk4vs
- SHA256 bfce22f0cf0ddb6920d38b612e3501360f5772edc85cce211df80a5797b5aa18
- MD5 dbdea804ef4eb5df7ae106edb4b755cb
- SHA1 c3d38d54e2cd86e77abdc34d5f1c9da160761aff
- SHA512 84d808bbea4f91bfe42a386fa9f9c88ddc7157299e5ae4bbc15b83f9769eb8084aafa36414ff64addac82edd1391350b97f6c69d916175be252b3a4d85473381
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\responder.exe\"" responder.exe - ServiceHost packer 5 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/2504-10-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2504-11-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2504-14-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2504-12-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2504-13-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 1 IoCs
pid Process 2288 responder.exe - Deletes itself 1 IoCs
pid Process 2288 responder.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: responder.exe File opened (read-only) \??\U: responder.exe File opened (read-only) \??\Y: responder.exe File opened (read-only) \??\B: responder.exe File opened (read-only) \??\E: responder.exe File opened (read-only) \??\I: responder.exe File opened (read-only) \??\K: responder.exe File opened (read-only) \??\T: responder.exe File opened (read-only) \??\X: responder.exe File opened (read-only) \??\Z: responder.exe File opened (read-only) \??\F: responder.exe File opened (read-only) \??\H: responder.exe File opened (read-only) \??\J: responder.exe File opened (read-only) \??\S: responder.exe File opened (read-only) \??\W: responder.exe File opened (read-only) \??\G: responder.exe File opened (read-only) \??\M: responder.exe File opened (read-only) \??\P: responder.exe File opened (read-only) \??\Q: responder.exe File opened (read-only) \??\V: responder.exe File opened (read-only) \??\A: responder.exe File opened (read-only) \??\L: responder.exe File opened (read-only) \??\N: responder.exe File opened (read-only) \??\R: responder.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1960 2504 WerFault.exe 79 - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2288 responder.exe 2288 responder.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe 1960 WerFault.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1960 WerFault.exe Token: SeBackupPrivilege 1960 WerFault.exe Token: SeDebugPrivilege 1960 WerFault.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 984 wrote to memory of 2288 984 dbdea804ef4eb5df7ae106edb4b755cb.exe 78 PID 984 wrote to memory of 2288 984 dbdea804ef4eb5df7ae106edb4b755cb.exe 78 PID 984 wrote to memory of 2288 984 dbdea804ef4eb5df7ae106edb4b755cb.exe 78 PID 2288 wrote to memory of 2504 2288 responder.exe 79 PID 2288 wrote to memory of 2504 2288 responder.exe 79 PID 2288 wrote to memory of 2504 2288 responder.exe 79 PID 2288 wrote to memory of 2504 2288 responder.exe 79 PID 2288 wrote to memory of 2504 2288 responder.exe 79 PID 2288 wrote to memory of 2504 2288 responder.exe 79 PID 2288 wrote to memory of 2504 2288 responder.exe 79 PID 2288 wrote to memory of 2504 2288 responder.exe 79 PID 2288 wrote to memory of 2504 2288 responder.exe 79 PID 2288 wrote to memory of 2504 2288 responder.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbdea804ef4eb5df7ae106edb4b755cb.exe"C:\Users\Admin\AppData\Local\Temp\dbdea804ef4eb5df7ae106edb4b755cb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\ProgramData\ErrorResponder\responder.exeC:\ProgramData\ErrorResponder\responder.exe "C:\Users\Admin\AppData\Local\Temp\dbdea804ef4eb5df7ae106edb4b755cb.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\ErrorResponder\responder.exe3⤵PID:2504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 3404⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
-