Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
02-03-2021 20:23
Static task
static1
Behavioral task
behavioral1
Sample
ServApi.exe
Resource
win7v20201028
General
-
Target
ServApi.exe
-
Size
281KB
-
MD5
19ca9bf5eebc9e2f0bd3230f262348fd
-
SHA1
e8157d7e277ccf04de3476c1845cd597c112786e
-
SHA256
f2a883a0e4b01c72b0f063df3be5a0102e5c8fbaedc39c8d35c632b200599283
-
SHA512
636859bd44528e75e5c6c25ad4fce12e0482fdd0de3798c863efbf4326e77db184b1354fc5433672239dee4350a0fc12427acc9a4bedfd17487e96ee5e397d72
Malware Config
Extracted
buer
verstudiosan.com
Signatures
-
Buer Loader 1 IoCs
Detects Buer loader in memory or disk.
Processes:
resource yara_rule behavioral1/memory/1712-5-0x0000000040000000-0x0000000040009000-memory.dmp buer -
Loads dropped DLL 1 IoCs
Processes:
ServApi.exepid process 1340 ServApi.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ServApi.exedescription pid process target process PID 1340 set thread context of 1712 1340 ServApi.exe ServApi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ServApi.exepid process 1340 ServApi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ServApi.exedescription pid process target process PID 1340 wrote to memory of 1712 1340 ServApi.exe ServApi.exe PID 1340 wrote to memory of 1712 1340 ServApi.exe ServApi.exe PID 1340 wrote to memory of 1712 1340 ServApi.exe ServApi.exe PID 1340 wrote to memory of 1712 1340 ServApi.exe ServApi.exe PID 1340 wrote to memory of 1712 1340 ServApi.exe ServApi.exe PID 1340 wrote to memory of 1712 1340 ServApi.exe ServApi.exe PID 1340 wrote to memory of 1712 1340 ServApi.exe ServApi.exe PID 1340 wrote to memory of 1712 1340 ServApi.exe ServApi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ServApi.exe"C:\Users\Admin\AppData\Local\Temp\ServApi.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\ServApi.exe"C:\Users\Admin\AppData\Local\Temp\ServApi.exe"2⤵PID:1712
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
0063d48afe5a0cdc02833145667b6641
SHA1e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA256ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
SHA51271cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0