Overview

overview

10

Static

static

8

2049191a8e...70.exe

windows7_x64

8

2049191a8e...70.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15-05-2021 14:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670.exe

  • Size

    434KB

  • MD5

    b5d4146d585d33490dca0e55682b2492

  • SHA1

    280386782e0dfad5991a218e1601ec5ca7ebc67b

  • SHA256

    2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670

  • SHA512

    31a9b11b9ffeb1fa4c8b10827917c99caf501276c5f55456bd1b2249f67926ccc011327c92722e8c4f7360f39b6e0d02895f705bf21d49bc4c12d29a425d8ab0

Score
10/10
badrabbitpersistenceransomwareupx

Malware Config

Signatures

  • BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit
  • Executes dropped EXE 27 IoCs
  • UPX packed file 52 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670.exe
    "C:\Users\Admin\AppData\Local\Temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2112
    • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202.exe
      c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:584
      • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202a.exe
        c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202a.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:848
        • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202b.exe
          c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202b.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:476
          • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202c.exe
            c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202c.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1360
  • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202d.exe
    c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202d.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1848
    • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202e.exe
      c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202e.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2352
      • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202f.exe
        c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202f.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2456
        • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202g.exe
          c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202g.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3968
          • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202h.exe
            c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202h.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4028
            • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202i.exe
              c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202i.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2988
              • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202j.exe
                c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202j.exe
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2756
                • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202k.exe
                  c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202k.exe
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:752
                  • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202l.exe
                    c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202l.exe
                    9⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:3288
  • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202m.exe
    c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202m.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3960
    • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202n.exe
      c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202n.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3964
      • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202o.exe
        c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202o.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3444
        • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202p.exe
          c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202p.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3372
          • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202q.exe
            c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202q.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:644
            • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202r.exe
              c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202r.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3360
              • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202s.exe
                c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202s.exe
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:788
                • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202t.exe
                  c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202t.exe
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1456
                  • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202u.exe
                    c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202u.exe
                    9⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Modifies registry class
                    PID:2344
                    • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202v.exe
                      c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202v.exe
                      10⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Modifies registry class
                      PID:2460
                      • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202w.exe
                        c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202w.exe
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Modifies registry class
                        PID:4032
                        • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202x.exe
                          c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202x.exe
                          12⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Modifies registry class
                          PID:3928
                          • \??\c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202y.exe
                            c:\users\admin\appdata\local\temp\2049191a8e78f562bd5c50b251d47bff344113a09da0a2bbd71d68325c3b7670_3202y.exe
                            13⤵
                            • Executes dropped EXE
                            • Modifies registry class
                            PID:2740
  • C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 15
    1⤵
      PID:3488
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
        • C:\Windows\SysWOW64\cmd.exe
          /c schtasks /Delete /F /TN rhaegal
          3⤵
            PID:1524
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Delete /F /TN rhaegal
              4⤵
                PID:3932
            • C:\Windows\SysWOW64\cmd.exe
              /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 240234305 && exit"
              3⤵
                PID:2840
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 240234305 && exit"
                  4⤵
                  • Creates scheduled task(s)
                  PID:2740
              • C:\Windows\SysWOW64\cmd.exe
                /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 00:42:00
                3⤵
                  PID:3876
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 00:42:00
                    4⤵
                    • Creates scheduled task(s)
                    PID:2416
                • C:\Windows\7F19.tmp
                  "C:\Windows\7F19.tmp" \\.\pipe\{4211F177-9797-4D98-91AB-9CB81FFB11E7}
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2752

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2744-193-0x0000000003210000-0x0000000003278000-memory.dmp

              Filesize

              416KB

              Download

            • memory/2744-198-0x0000000003210000-0x0000000003278000-memory.dmp

              Filesize

              416KB

              Download