Analysis
- max time kernel
155s - max time network
163s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae.exe
- Size 35KB
- Sample201110-84vrz1nama
- SHA256 87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae
- MD5 69c7b8274b687875a08b20311147a9dd
- SHA1 9ab047d53100e007c1ef89a0769a949d83d39367
- SHA512 fb13c89282524ec99e339d6d94d4fdb8f9e29d39fc72881937229737b7b90b1e3f27652f1e2c16975b08cdd70213dbc8fd092dc37e274dad0a2723dfbcbadd33
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
buer
C2
-
https://free-soft.cc/
-
https://free-pc-soft.cc/
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\responder.exe\"" responder.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\ProgramData\\ErrorResponder\\responder.exe\"" secinit.exe - Buer Loader 3 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral2/files/0x000300000001a0e3-1.dat buer behavioral2/files/0x000300000001a0e3-2.dat buer behavioral2/memory/2388-4-0x0000000000000000-mapping.dmp buer - Executes dropped EXE 1 IoCs
pid Process 3712 responder.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: secinit.exe File opened (read-only) \??\W: secinit.exe File opened (read-only) \??\X: secinit.exe File opened (read-only) \??\A: secinit.exe File opened (read-only) \??\F: secinit.exe File opened (read-only) \??\G: secinit.exe File opened (read-only) \??\K: secinit.exe File opened (read-only) \??\L: secinit.exe File opened (read-only) \??\M: secinit.exe File opened (read-only) \??\N: secinit.exe File opened (read-only) \??\E: secinit.exe File opened (read-only) \??\H: secinit.exe File opened (read-only) \??\I: secinit.exe File opened (read-only) \??\J: secinit.exe File opened (read-only) \??\S: secinit.exe File opened (read-only) \??\V: secinit.exe File opened (read-only) \??\Y: secinit.exe File opened (read-only) \??\B: secinit.exe File opened (read-only) \??\P: secinit.exe File opened (read-only) \??\Q: secinit.exe File opened (read-only) \??\R: secinit.exe File opened (read-only) \??\T: secinit.exe File opened (read-only) \??\U: secinit.exe File opened (read-only) \??\Z: secinit.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2388 secinit.exe 2388 secinit.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 428 wrote to memory of 3712 428 87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae.exe 79 PID 428 wrote to memory of 3712 428 87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae.exe 79 PID 428 wrote to memory of 3712 428 87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae.exe 79 PID 3712 wrote to memory of 2388 3712 responder.exe 80 PID 3712 wrote to memory of 2388 3712 responder.exe 80 PID 3712 wrote to memory of 2388 3712 responder.exe 80 PID 3712 wrote to memory of 2388 3712 responder.exe 80 PID 3712 wrote to memory of 2388 3712 responder.exe 80 PID 3712 wrote to memory of 2388 3712 responder.exe 80 PID 3712 wrote to memory of 2388 3712 responder.exe 80 PID 3712 wrote to memory of 2388 3712 responder.exe 80 PID 3712 wrote to memory of 2388 3712 responder.exe 80 PID 3712 wrote to memory of 2388 3712 responder.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae.exe"C:\Users\Admin\AppData\Local\Temp\87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\ProgramData\ErrorResponder\responder.exeC:\ProgramData\ErrorResponder\responder.exe "C:\Users\Admin\AppData\Local\Temp\87d4ae3570608110b899d582e238ddfff0c411be980adb48b1ba7177be2b14ae.exe" ensgJJ2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\secinit.exeC:\ProgramData\ErrorResponder\responder.exe3⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:2388
-
-