Resubmissions
05-02-2021 09:03
210205-vb23bmqh2n 1005-02-2021 08:52
210205-8n4dfc6e2j 1005-02-2021 00:36
210205-pj4d5hk8ys 10Analysis
-
max time kernel
1743s -
max time network
1768s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
05-02-2021 09:03
Static task
static1
Behavioral task
behavioral1
Sample
zrmbk.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
zrmbk.exe
Resource
win10v20201028
General
-
Target
zrmbk.exe
-
Size
97KB
-
MD5
9168378e6849f1547829afc3f0357f6a
-
SHA1
097d64d174b8243434f026f2fd24e536cc3686bc
-
SHA256
d333192a262ceaec75b68c0e6082cf868eb77a0e81010f590451814770b6ce31
-
SHA512
4c69f85af810334506dd1b8d2e409e30ce8c8471073b56bece6312dcda109705720c41255d49e1d7976b847f4ca586113208fdec805aac2398fc890fc230754b
Malware Config
Extracted
buer
officewestunionbank.com
bankcreditsign.com
Extracted
raccoon
fbb3ff62285b6085836cfe3d032d817936c927a9
-
url4cnc
https://telete.in/jvadikkamushkin
Signatures
-
Buer Loader 2 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral1/memory/1100-3-0x0000000000020000-0x0000000000027000-memory.dmp buer behavioral1/memory/1100-4-0x0000000040000000-0x0000000040009000-memory.dmp buer -
Loads dropped DLL 16 IoCs
pid Process 760 svchost.exe 760 svchost.exe 760 svchost.exe 760 svchost.exe 760 svchost.exe 760 svchost.exe 760 svchost.exe 760 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: zrmbk.exe File opened (read-only) \??\J: zrmbk.exe File opened (read-only) \??\A: zrmbk.exe File opened (read-only) \??\H: zrmbk.exe File opened (read-only) \??\K: zrmbk.exe File opened (read-only) \??\L: zrmbk.exe File opened (read-only) \??\V: zrmbk.exe File opened (read-only) \??\W: zrmbk.exe File opened (read-only) \??\B: zrmbk.exe File opened (read-only) \??\G: zrmbk.exe File opened (read-only) \??\I: zrmbk.exe File opened (read-only) \??\P: zrmbk.exe File opened (read-only) \??\T: zrmbk.exe File opened (read-only) \??\R: zrmbk.exe File opened (read-only) \??\S: zrmbk.exe File opened (read-only) \??\U: zrmbk.exe File opened (read-only) \??\E: zrmbk.exe File opened (read-only) \??\M: zrmbk.exe File opened (read-only) \??\N: zrmbk.exe File opened (read-only) \??\O: zrmbk.exe File opened (read-only) \??\Q: zrmbk.exe File opened (read-only) \??\X: zrmbk.exe File opened (read-only) \??\Y: zrmbk.exe File opened (read-only) \??\Z: zrmbk.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1100 set thread context of 760 1100 zrmbk.exe 29 PID 1100 set thread context of 832 1100 zrmbk.exe 34 -
Delays execution with timeout.exe 2 IoCs
pid Process 992 timeout.exe 1108 timeout.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 1100 wrote to memory of 760 1100 zrmbk.exe 29 PID 760 wrote to memory of 1592 760 svchost.exe 31 PID 760 wrote to memory of 1592 760 svchost.exe 31 PID 760 wrote to memory of 1592 760 svchost.exe 31 PID 760 wrote to memory of 1592 760 svchost.exe 31 PID 1592 wrote to memory of 992 1592 cmd.exe 33 PID 1592 wrote to memory of 992 1592 cmd.exe 33 PID 1592 wrote to memory of 992 1592 cmd.exe 33 PID 1592 wrote to memory of 992 1592 cmd.exe 33 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 1100 wrote to memory of 832 1100 zrmbk.exe 34 PID 832 wrote to memory of 296 832 svchost.exe 35 PID 832 wrote to memory of 296 832 svchost.exe 35 PID 832 wrote to memory of 296 832 svchost.exe 35 PID 832 wrote to memory of 296 832 svchost.exe 35 PID 296 wrote to memory of 1108 296 cmd.exe 37 PID 296 wrote to memory of 1108 296 cmd.exe 37 PID 296 wrote to memory of 1108 296 cmd.exe 37 PID 296 wrote to memory of 1108 296 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\zrmbk.exe"C:\Users\Admin\AppData\Local\Temp\zrmbk.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Windows\SysWOW64\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:992
-
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Windows\SysWOW64\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:1108
-
-
-