Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:06
Behavioral task
behavioral1
Sample
b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe
-
Size
1.1MB
-
MD5
b5ffd4ecdf7f1d4eb5f13a7207c5e4a5
-
SHA1
145b3ed98ffe2ca15172dcabf52a76ecd33bd657
-
SHA256
615b9395be665d265953e69924b4df1808eda0fd40381d6d469bf4c362590125
-
SHA512
8e918bc2304f7e761736d2c03494bf278c854fdfb30ec7d7459fd1cfbcdd88c279396d55d0d8954389d742d6e3f46b99bb93dbce3137c26d1ca95e3ee8c93ea3
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\RedTools\\networker.exe\"" networker.exe -
Buer Loader 4 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral1/files/0x001900000000f55b-0.dat buer behavioral1/files/0x001900000000f55b-2.dat buer behavioral1/files/0x001900000000f55b-3.dat buer behavioral1/memory/912-5-0x0000000000000000-mapping.dmp buer -
Executes dropped EXE 1 IoCs
pid Process 924 networker.exe -
resource yara_rule behavioral1/files/0x001900000000f55b-0.dat vmprotect behavioral1/files/0x001900000000f55b-2.dat vmprotect behavioral1/files/0x001900000000f55b-3.dat vmprotect -
Deletes itself 1 IoCs
pid Process 924 networker.exe -
Loads dropped DLL 1 IoCs
pid Process 1704 b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: networker.exe File opened (read-only) \??\J: networker.exe File opened (read-only) \??\K: networker.exe File opened (read-only) \??\M: networker.exe File opened (read-only) \??\S: networker.exe File opened (read-only) \??\U: networker.exe File opened (read-only) \??\Z: networker.exe File opened (read-only) \??\A: networker.exe File opened (read-only) \??\F: networker.exe File opened (read-only) \??\H: networker.exe File opened (read-only) \??\P: networker.exe File opened (read-only) \??\Q: networker.exe File opened (read-only) \??\B: networker.exe File opened (read-only) \??\E: networker.exe File opened (read-only) \??\I: networker.exe File opened (read-only) \??\L: networker.exe File opened (read-only) \??\R: networker.exe File opened (read-only) \??\T: networker.exe File opened (read-only) \??\W: networker.exe File opened (read-only) \??\X: networker.exe File opened (read-only) \??\N: networker.exe File opened (read-only) \??\O: networker.exe File opened (read-only) \??\V: networker.exe File opened (read-only) \??\Y: networker.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 924 networker.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1704 wrote to memory of 924 1704 b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe 29 PID 1704 wrote to memory of 924 1704 b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe 29 PID 1704 wrote to memory of 924 1704 b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe 29 PID 1704 wrote to memory of 924 1704 b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe 29 PID 924 wrote to memory of 912 924 networker.exe 30 PID 924 wrote to memory of 912 924 networker.exe 30 PID 924 wrote to memory of 912 924 networker.exe 30 PID 924 wrote to memory of 912 924 networker.exe 30 PID 924 wrote to memory of 912 924 networker.exe 30 PID 924 wrote to memory of 912 924 networker.exe 30 PID 924 wrote to memory of 912 924 networker.exe 30 PID 924 wrote to memory of 912 924 networker.exe 30 PID 924 wrote to memory of 912 924 networker.exe 30 PID 924 wrote to memory of 912 924 networker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe"C:\Users\Admin\AppData\Local\Temp\b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\ProgramData\RedTools\networker.exeC:\ProgramData\RedTools\networker.exe "C:\Users\Admin\AppData\Local\Temp\b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\RedTools\networker.exe3⤵PID:912
-
-