ebf29f6e0d7487301d2670db3686b07bfbb4a7cce0ea022ac03cac9d16deeb78

Analysis

max time kernel
153s
max time network
10s
platform
windows7_x64
resource
win7v20210408
submitted
23-04-2021 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
Size

2.0MB
MD5

8540e2be7e84f2ddc37499b0a3aeb53f
SHA1

4767ac2a0eb586d52fa20a0253cbfce6c7ce198f
SHA256

0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7
SHA512

4ffcec4f7886ea371e4b5a6628aba29390f17dd6ea8d0746680fc7ea3105d77ad0d7a825d0ac6823e01d52a4c206b4f6fa4cb6a6d813e2f9521fb12e3b52dd35

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

WinConnection.exerkverify.exe

pid process

1672 WinConnection.exe
1580 rkverify.exe

pid	process
1672	WinConnection.exe
1580	rkverify.exe

Loads dropped DLL 20 IoCs

Processes:

0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exeWinConnection.exerkverify.exe

pid	process
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1672	WinConnection.exe
1672	WinConnection.exe
1672	WinConnection.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe

Drops file in System32 directory 1 IoCs

Processes:

0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe

description ioc process

File created C:\Windows\SysWOW64\GLBSINST.%$D 0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rkverify.exe

pid	process
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe
1580	rkverify.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

rkverify.exe

pid process

1580 rkverify.exe
1580 rkverify.exe
1580 rkverify.exe
1580 rkverify.exe
1580 rkverify.exe
1580 rkverify.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe

description	pid	process	target process
PID 1944 wrote to memory of 1672	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	WinConnection.exe
PID 1944 wrote to memory of 1672	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	WinConnection.exe
PID 1944 wrote to memory of 1672	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	WinConnection.exe
PID 1944 wrote to memory of 1672	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	WinConnection.exe
PID 1944 wrote to memory of 1672	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	WinConnection.exe
PID 1944 wrote to memory of 1672	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	WinConnection.exe
PID 1944 wrote to memory of 1672	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	WinConnection.exe
PID 1944 wrote to memory of 1580	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	rkverify.exe
PID 1944 wrote to memory of 1580	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	rkverify.exe
PID 1944 wrote to memory of 1580	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	rkverify.exe
PID 1944 wrote to memory of 1580	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	rkverify.exe
PID 1944 wrote to memory of 1580	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	rkverify.exe
PID 1944 wrote to memory of 1580	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	rkverify.exe
PID 1944 wrote to memory of 1580	1944	0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe	rkverify.exe

C:\Users\Admin\AppData\Local\Temp\0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe
"C:\Users\Admin\AppData\Local\Temp\0093b3e67f9ac01a1b5ebedb7046a8e881bc403892288fe531c03018e41401d7.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\WinConnection.exe
"C:\Users\Admin\AppData\Local\Temp\WinConnection.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672

C:\Users\Admin\AppData\Local\Temp\rkverify.exe
"C:\Users\Admin\AppData\Local\Temp\rkverify.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1580

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CSMADCC.tmp
MD5
5ac09190daf249c3e93c3ac961067024

SHA1
bad9c0d552d54310f669d66b549dcada90583812

SHA256
f4934185f75518a13ef5425959f47516cc8467f513e838a82e749ffb782d7e23

SHA512
2a87686c038e8a34f8e04a844726de564a08baeedc87632219b86f455d5222efe2ed7557fad9658627e304d916a75cfcb3c9dede4e72057a070f64370aa52f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinConnection.exe
MD5
beee2adf7123f511cc259a1318c0e93d

SHA1
186eb9ef6db540e2a1843127554351b6a7356904

SHA256
8da017a8083013c46da2a3539cbe8388078f40a288cc85d352c182aaa39ddd1a

SHA512
2633bed8e263fbe8ea9c854f470c02d6a622bb6de63afdb4812493459737a793062308822065542abf72db18c9e076d2eb9cc52a9dbdf30d556807b5b1811a70

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinConnection.exe
MD5
beee2adf7123f511cc259a1318c0e93d

SHA1
186eb9ef6db540e2a1843127554351b6a7356904

SHA256
8da017a8083013c46da2a3539cbe8388078f40a288cc85d352c182aaa39ddd1a

SHA512
2633bed8e263fbe8ea9c854f470c02d6a622bb6de63afdb4812493459737a793062308822065542abf72db18c9e076d2eb9cc52a9dbdf30d556807b5b1811a70

Download Submit
C:\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
C:\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
\Users\Admin\AppData\Local\Temp\CSMADCC.tmp
MD5
5ac09190daf249c3e93c3ac961067024

SHA1
bad9c0d552d54310f669d66b549dcada90583812

SHA256
f4934185f75518a13ef5425959f47516cc8467f513e838a82e749ffb782d7e23

SHA512
2a87686c038e8a34f8e04a844726de564a08baeedc87632219b86f455d5222efe2ed7557fad9658627e304d916a75cfcb3c9dede4e72057a070f64370aa52f39

Download Submit
\Users\Admin\AppData\Local\Temp\CSMADCC.tmp
MD5
5ac09190daf249c3e93c3ac961067024

SHA1
bad9c0d552d54310f669d66b549dcada90583812

SHA256
f4934185f75518a13ef5425959f47516cc8467f513e838a82e749ffb782d7e23

SHA512
2a87686c038e8a34f8e04a844726de564a08baeedc87632219b86f455d5222efe2ed7557fad9658627e304d916a75cfcb3c9dede4e72057a070f64370aa52f39

Download Submit
\Users\Admin\AppData\Local\Temp\GLC9CFB.tmp
MD5
09e59d00df5d2effd8dd9b30385cb9d2

SHA1
0fa0d3f6692f31fdabefb719b0f7a28cbf5d5415

SHA256
1c574eab5e83ccfe5a0bb7b59e028cc5fa2f4e77868051e305d83c709711ff77

SHA512
d73e3832777341a4176dbd9988002ec94a32f162492e869a8c03d9bb10f1833821f99e15710e9fc103a2820c862cf14a0b990d7c7c09150bb14618a7c93ca5fd

Download Submit
\Users\Admin\AppData\Local\Temp\GLFA9E9.tmp
MD5
9da8f742593d4bbca708b90725282ae2

SHA1
9aaa6ed98726e657252a098f2bf06066a8604d27

SHA256
e362a9815527869e0f71fdf766a1c3648e307145defda7a5279914e522bcb57c

SHA512
f8b4129dc4ab30e009cb4db8a80f06b16306c1a90a49e534befb925d6ce4d5713b98553a2107b40efa8b5abd025ff0556976cf46c3642ce8e372c34d105e36cb

Download Submit
\Users\Admin\AppData\Local\Temp\GLK9D59.tmp
MD5
517419cae37f6c78c80f9b7d0fbb8661

SHA1
a9e419f3d9ef589522556e0920c84fe37a548873

SHA256
bfe7e013cfb85e78b994d3ad34eca08286494a835cb85f1d7bced3df6fe93a11

SHA512
5046565443cf463b6fa4d2d5868879efc6a9db969bf05e3c80725b99bd091ce062cfe66c5551eb1cc5f00a38f2cfcda1f36fb4d60d9ff816c4ec3107b5a0df40

Download Submit
\Users\Admin\AppData\Local\Temp\WinConnection.exe
MD5
beee2adf7123f511cc259a1318c0e93d

SHA1
186eb9ef6db540e2a1843127554351b6a7356904

SHA256
8da017a8083013c46da2a3539cbe8388078f40a288cc85d352c182aaa39ddd1a

SHA512
2633bed8e263fbe8ea9c854f470c02d6a622bb6de63afdb4812493459737a793062308822065542abf72db18c9e076d2eb9cc52a9dbdf30d556807b5b1811a70

Download Submit
\Users\Admin\AppData\Local\Temp\WinConnection.exe
MD5
beee2adf7123f511cc259a1318c0e93d

SHA1
186eb9ef6db540e2a1843127554351b6a7356904

SHA256
8da017a8083013c46da2a3539cbe8388078f40a288cc85d352c182aaa39ddd1a

SHA512
2633bed8e263fbe8ea9c854f470c02d6a622bb6de63afdb4812493459737a793062308822065542abf72db18c9e076d2eb9cc52a9dbdf30d556807b5b1811a70

Download Submit
\Users\Admin\AppData\Local\Temp\WinConnection.exe
MD5
beee2adf7123f511cc259a1318c0e93d

SHA1
186eb9ef6db540e2a1843127554351b6a7356904

SHA256
8da017a8083013c46da2a3539cbe8388078f40a288cc85d352c182aaa39ddd1a

SHA512
2633bed8e263fbe8ea9c854f470c02d6a622bb6de63afdb4812493459737a793062308822065542abf72db18c9e076d2eb9cc52a9dbdf30d556807b5b1811a70

Download Submit
\Users\Admin\AppData\Local\Temp\WinConnection.exe
MD5
beee2adf7123f511cc259a1318c0e93d

SHA1
186eb9ef6db540e2a1843127554351b6a7356904

SHA256
8da017a8083013c46da2a3539cbe8388078f40a288cc85d352c182aaa39ddd1a

SHA512
2633bed8e263fbe8ea9c854f470c02d6a622bb6de63afdb4812493459737a793062308822065542abf72db18c9e076d2eb9cc52a9dbdf30d556807b5b1811a70

Download Submit
\Users\Admin\AppData\Local\Temp\WinConnection.exe
MD5
beee2adf7123f511cc259a1318c0e93d

SHA1
186eb9ef6db540e2a1843127554351b6a7356904

SHA256
8da017a8083013c46da2a3539cbe8388078f40a288cc85d352c182aaa39ddd1a

SHA512
2633bed8e263fbe8ea9c854f470c02d6a622bb6de63afdb4812493459737a793062308822065542abf72db18c9e076d2eb9cc52a9dbdf30d556807b5b1811a70

Download Submit
\Users\Admin\AppData\Local\Temp\WinConnection.exe
MD5
beee2adf7123f511cc259a1318c0e93d

SHA1
186eb9ef6db540e2a1843127554351b6a7356904

SHA256
8da017a8083013c46da2a3539cbe8388078f40a288cc85d352c182aaa39ddd1a

SHA512
2633bed8e263fbe8ea9c854f470c02d6a622bb6de63afdb4812493459737a793062308822065542abf72db18c9e076d2eb9cc52a9dbdf30d556807b5b1811a70

Download Submit
\Users\Admin\AppData\Local\Temp\WinConnection.exe
MD5
beee2adf7123f511cc259a1318c0e93d

SHA1
186eb9ef6db540e2a1843127554351b6a7356904

SHA256
8da017a8083013c46da2a3539cbe8388078f40a288cc85d352c182aaa39ddd1a

SHA512
2633bed8e263fbe8ea9c854f470c02d6a622bb6de63afdb4812493459737a793062308822065542abf72db18c9e076d2eb9cc52a9dbdf30d556807b5b1811a70

Download Submit
\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
\Users\Admin\AppData\Local\Temp\rkverify.exe
MD5
020ce95075f8c93e6cc957953d7f4589

SHA1
e192a200e36974b8e0637230a8cb5905090f7555

SHA256
df9d068202c060a898cd441d5c170686cd9c2774a37cfda3ea10abc428e20ad3

SHA512
fb74170ed9b5ee078a176540c198513ed3a8c2e587fbcbf6d2384f840f0b6a2637fd20b6a01b2caf6e92e5f592d517b4733d34fdb349fd770eb04e1eac769170

Download Submit
memory/1580-80-0x0000000000000000-mapping.dmp

Download
memory/1672-68-0x0000000000000000-mapping.dmp

Download
memory/1944-60-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1944-90-0x0000000000390000-0x00000000003B8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads