Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
6ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10Resubmissions
24-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 1024-07-2023 06:25
230724-g6s6laag35 1022-07-2023 15:57
230722-tee6wabg5w 1020-07-2023 23:19
230720-3bb5gsbf5v 1020-07-2023 23:06
230720-23f23sba63 1003-02-2021 11:43
210203-6bgge2nfan 1022-11-2020 06:42
201122-6x1at779dj 10Analysis
-
max time kernel
913s -
max time network
922s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-11-2020 06:42
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@000.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Endermanch@7ev3n.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Endermanch@AnViPC2009.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Endermanch@Antivirus.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Endermanch@AntivirusPlatinum.exe
Resource
win10v20201028
Behavioral task
behavioral6
Sample
Endermanch@AntivirusPro2017.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
Endermanch@BadRabbit.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
Endermanch@Birele.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
Endermanch@Cerber5.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
Endermanch@CleanThis.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
Endermanch@ColorBug.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
Endermanch@DeriaLock.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Endermanch@Deskbottom.exe
Resource
win10v20201028
Behavioral task
behavioral14
Sample
Endermanch@DesktopPuzzle.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
Endermanch@HMBlocker.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
Endermanch@HappyAntivirus.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
Endermanch@Illerka.C.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
Endermanch@Koteyka2.exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
Endermanch@LPS2019.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
Endermanch@Movie.mpeg.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
Endermanch@NavaShield(1).exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
Endermanch@NavaShield.exe
Resource
win10v20201028
Behavioral task
behavioral26
Sample
Endermanch@PCDefender.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
Endermanch@PCDefenderv2.msi
Resource
win10v20201028
Behavioral task
behavioral28
Sample
Endermanch@PolyRansom.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
Endermanch@PowerPoint.exe
Resource
win10v20201028
Behavioral task
behavioral30
Sample
Endermanch@ProgramOverflow.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
Endermanch@RegistrySmart.exe
Resource
win10v20201028
Behavioral task
behavioral32
Sample
Endermanch@SE2011.exe
Resource
win10v20201028
Errors
General
-
Target
Endermanch@BadRabbit.exe
-
Size
431KB
-
MD5
fbbdc39af1139aebba4da004475e8839
-
SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0
-
SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
-
SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Deletes NTFS Change Journal 2 TTPs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
-
Clears Windows event logs 1 TTPs
-
Blacklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 295 2664 rundll32.exe 308 2664 rundll32.exe -
Executes dropped EXE 1 IoCs
Processes:
9B0D.tmppid process 1312 9B0D.tmp -
Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe -
Drops file in Windows directory 5 IoCs
Processes:
rundll32.exeEndermanch@BadRabbit.exedescription ioc process File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\9B0D.tmp rundll32.exe File created C:\Windows\infpub.dat Endermanch@BadRabbit.exe File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1124 schtasks.exe 2728 schtasks.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
rundll32.exe9B0D.tmppid process 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 1312 9B0D.tmp 1312 9B0D.tmp 1312 9B0D.tmp 1312 9B0D.tmp 1312 9B0D.tmp 1312 9B0D.tmp -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
rundll32.exe9B0D.tmpwevtutil.exewevtutil.exewevtutil.exewevtutil.exedescription pid process Token: SeShutdownPrivilege 2664 rundll32.exe Token: SeDebugPrivilege 2664 rundll32.exe Token: SeTcbPrivilege 2664 rundll32.exe Token: SeDebugPrivilege 1312 9B0D.tmp Token: SeSecurityPrivilege 3320 wevtutil.exe Token: SeBackupPrivilege 3320 wevtutil.exe Token: SeSecurityPrivilege 1404 wevtutil.exe Token: SeBackupPrivilege 1404 wevtutil.exe Token: SeSecurityPrivilege 3100 wevtutil.exe Token: SeBackupPrivilege 3100 wevtutil.exe Token: SeSecurityPrivilege 3880 wevtutil.exe Token: SeBackupPrivilege 3880 wevtutil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 3508 LogonUI.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
Endermanch@BadRabbit.exerundll32.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1152 wrote to memory of 2664 1152 Endermanch@BadRabbit.exe rundll32.exe PID 1152 wrote to memory of 2664 1152 Endermanch@BadRabbit.exe rundll32.exe PID 1152 wrote to memory of 2664 1152 Endermanch@BadRabbit.exe rundll32.exe PID 2664 wrote to memory of 1028 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 1028 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 1028 2664 rundll32.exe cmd.exe PID 1028 wrote to memory of 3412 1028 cmd.exe schtasks.exe PID 1028 wrote to memory of 3412 1028 cmd.exe schtasks.exe PID 1028 wrote to memory of 3412 1028 cmd.exe schtasks.exe PID 2664 wrote to memory of 1956 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 1956 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 1956 2664 rundll32.exe cmd.exe PID 1956 wrote to memory of 2728 1956 cmd.exe schtasks.exe PID 1956 wrote to memory of 2728 1956 cmd.exe schtasks.exe PID 1956 wrote to memory of 2728 1956 cmd.exe schtasks.exe PID 2664 wrote to memory of 4076 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 4076 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 4076 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 1312 2664 rundll32.exe 9B0D.tmp PID 2664 wrote to memory of 1312 2664 rundll32.exe 9B0D.tmp PID 4076 wrote to memory of 1124 4076 cmd.exe schtasks.exe PID 4076 wrote to memory of 1124 4076 cmd.exe schtasks.exe PID 4076 wrote to memory of 1124 4076 cmd.exe schtasks.exe PID 2664 wrote to memory of 4032 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 4032 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 4032 2664 rundll32.exe cmd.exe PID 4032 wrote to memory of 3320 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 3320 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 3320 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 1404 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 1404 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 1404 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 3100 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 3100 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 3100 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 3880 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 3880 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 3880 4032 cmd.exe wevtutil.exe PID 4032 wrote to memory of 4040 4032 cmd.exe fsutil.exe PID 4032 wrote to memory of 4040 4032 cmd.exe fsutil.exe PID 4032 wrote to memory of 4040 4032 cmd.exe fsutil.exe PID 2664 wrote to memory of 3756 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 3756 2664 rundll32.exe cmd.exe PID 2664 wrote to memory of 3756 2664 rundll32.exe cmd.exe PID 3756 wrote to memory of 696 3756 cmd.exe schtasks.exe PID 3756 wrote to memory of 696 3756 cmd.exe schtasks.exe PID 3756 wrote to memory of 696 3756 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@BadRabbit.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@BadRabbit.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Blacklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3648423931 && exit"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3648423931 && exit"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:003⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 06:59:004⤵
- Creates scheduled task(s)
-
C:\Windows\9B0D.tmp"C:\Windows\9B0D.tmp" \\.\pipe\{38E23F7D-634F-42C4-845E-BD602073FE9F}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Setup4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl System4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Security4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Application4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\fsutil.exefsutil usn deletejournal /D C:4⤵
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN drogon3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN drogon4⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad4055 /state1:0x41c64e6d1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\9B0D.tmpMD5
347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
C:\Windows\9B0D.tmpMD5
347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
C:\Windows\infpub.datMD5
1d724f95c61f1055f0d02c2154bbccd3
SHA179116fe99f2b421c52ef64097f0f39b815b20907
SHA256579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648
SHA512f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113
-
memory/696-19-0x0000000000000000-mapping.dmp
-
memory/1028-3-0x0000000000000000-mapping.dmp
-
memory/1124-11-0x0000000000000000-mapping.dmp
-
memory/1312-8-0x0000000000000000-mapping.dmp
-
memory/1404-14-0x0000000000000000-mapping.dmp
-
memory/1956-5-0x0000000000000000-mapping.dmp
-
memory/2664-0-0x0000000000000000-mapping.dmp
-
memory/2664-2-0x0000000004930000-0x0000000004998000-memory.dmpFilesize
416KB
-
memory/2728-6-0x0000000000000000-mapping.dmp
-
memory/3100-15-0x0000000000000000-mapping.dmp
-
memory/3320-13-0x0000000000000000-mapping.dmp
-
memory/3412-4-0x0000000000000000-mapping.dmp
-
memory/3756-18-0x0000000000000000-mapping.dmp
-
memory/3880-16-0x0000000000000000-mapping.dmp
-
memory/4032-12-0x0000000000000000-mapping.dmp
-
memory/4040-17-0x0000000000000000-mapping.dmp
-
memory/4076-7-0x0000000000000000-mapping.dmp