6accf3170e51cbc04fe58bb862180687c69b36a692abfac21428d1c3bbcf0c61

Analysis

max time kernel
150s
max time network
116s
platform
windows10_x64
resource
win10v20210408
submitted
11-05-2021 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6accf3170e51cbc04fe58bb862180687c69b36a692abfac21428d1c3bbcf0c61.exe
Size

694KB
MD5

0641edc07e6ae6c78053d1cab52a0353
SHA1

fa33b2e679f1a96e337f9a8cfa04ac73b1a94f57
SHA256

6accf3170e51cbc04fe58bb862180687c69b36a692abfac21428d1c3bbcf0c61
SHA512

7d30fba227241eed3fbcac4019101d51e8027c70bc01976f12985e61e40d542afafb5fd8b257bee1d4d12b8df2775fb15744c3aaadb682cff90ffd546da1cef0

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rxilxn.exe

pid process

3336 rxilxn.exe

pid	process
3336	rxilxn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rxilxn.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\rxilxn.exe"	rxilxn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6accf3170e51cbc04fe58bb862180687c69b36a692abfac21428d1c3bbcf0c61.exe

description	pid	process	target process
PID 812 wrote to memory of 3336	812	6accf3170e51cbc04fe58bb862180687c69b36a692abfac21428d1c3bbcf0c61.exe	rxilxn.exe
PID 812 wrote to memory of 3336	812	6accf3170e51cbc04fe58bb862180687c69b36a692abfac21428d1c3bbcf0c61.exe	rxilxn.exe
PID 812 wrote to memory of 3336	812	6accf3170e51cbc04fe58bb862180687c69b36a692abfac21428d1c3bbcf0c61.exe	rxilxn.exe

C:\Users\Admin\AppData\Local\Temp\6accf3170e51cbc04fe58bb862180687c69b36a692abfac21428d1c3bbcf0c61.exe
"C:\Users\Admin\AppData\Local\Temp\6accf3170e51cbc04fe58bb862180687c69b36a692abfac21428d1c3bbcf0c61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\ProgramData\rxilxn.exe
"C:\ProgramData\rxilxn.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3336

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Saaaalamm\Mira.h
MD5
3b199066399b355a1567696853b81067

SHA1
fc6141e5285acc40a362420ee5779b90b16aea64

SHA256
b79fa16bcf19176850f07c841a98aefb3f149bf9004dcd70f71fdc980e3fec1d

SHA512
48d87eed230ab65fdd4e00e528ca334123d1fd41a315b3428dbad35158083057bd92a091fdf77982a756851ac22fb8f18e7edcaf0e7625c938a2412ac5e24198

Download Submit
C:\ProgramData\rxilxn.exe
MD5
dbd369c52b9280ac3b338166f1179b9e

SHA1
c262ef76451b3ff07e5d2edc7b7920acb5f2e4a0

SHA256
f2e9e8bfe52c2cfe43faf62a571e6ab26d768f5c9497bfa042db7433ad57afff

SHA512
0d332b655d4733194b47614ea8606f868fd1fc5942180fa9497a71f19f8c3d2b70b4d7731332b01a59aec66f3ef0c93aca50fecb3d7a73a7b95f570578d7de6c

Download Submit
C:\ProgramData\rxilxn.exe
MD5
dbd369c52b9280ac3b338166f1179b9e

SHA1
c262ef76451b3ff07e5d2edc7b7920acb5f2e4a0

SHA256
f2e9e8bfe52c2cfe43faf62a571e6ab26d768f5c9497bfa042db7433ad57afff

SHA512
0d332b655d4733194b47614ea8606f868fd1fc5942180fa9497a71f19f8c3d2b70b4d7731332b01a59aec66f3ef0c93aca50fecb3d7a73a7b95f570578d7de6c

Download Submit
memory/3336-114-0x0000000000000000-mapping.dmp

Download