Overview

overview

10

Static

static

da2d865045...ec.exe

windows7_x64

6

da2d865045...ec.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15-05-2021 14:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    da2d8650452e6d1f8eaaaadac6b9ff015c99615d4e0b97ede0d462f1ed91f3ec.exe

  • Size

    880KB

  • MD5

    ba92eb82a0d8e11e398699805443ddfb

  • SHA1

    1be55fa2dfb0d523160a96294f15f08d5af65808

  • SHA256

    da2d8650452e6d1f8eaaaadac6b9ff015c99615d4e0b97ede0d462f1ed91f3ec

  • SHA512

    24e59f57f059e683abf567c77b78d7899888c8c8f419aa1429e2d22b6c01b6d835a7d532d4c58e0a075dc9b41bd959df3c06f1239fd32ccbd071e672275764f3

Score
10/10
badrabbitransomware

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops desktop.ini file(s) 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da2d8650452e6d1f8eaaaadac6b9ff015c99615d4e0b97ede0d462f1ed91f3ec.exe
    "C:\Users\Admin\AppData\Local\Temp\da2d8650452e6d1f8eaaaadac6b9ff015c99615d4e0b97ede0d462f1ed91f3ec.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:3868
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 736
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:192
  • C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
      2⤵
      • Modifies extensions of user files
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2056
      • C:\Windows\SysWOW64\cmd.exe
        /c schtasks /Delete /F /TN rhaegal
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2308
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Delete /F /TN rhaegal
          4⤵
            PID:3748
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 272757890 && exit"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2076
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 272757890 && exit"
            4⤵
            • Creates scheduled task(s)
            PID:3136
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 00:43:00
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2736
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 00:43:00
            4⤵
            • Creates scheduled task(s)
            PID:2696
        • C:\Windows\3096.tmp
          "C:\Windows\3096.tmp" \\.\pipe\{2292D0AD-7E1C-45A1-80EC-C9063875BF67}
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3676

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2056-115-0x0000000000B00000-0x0000000000B68000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2056-120-0x0000000000B00000-0x0000000000B68000-memory.dmp

      Filesize

      416KB

      Download