Analysis

  • max time kernel
    12s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    18-06-2021 20:03

General

  • Target

    d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe.bin.exe

  • Size

    113KB

  • MD5

    1c3db7002523e1acd621c90701c694ae

  • SHA1

    aee092fd31772d33932a7a02dd2d73ede67f7db0

  • SHA256

    d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe

  • SHA512

    e94cd7fa788fa2f828dd40fe096b25655d7b8fe9fd948c5b53f6c30039ca0b9c309ebf8619c0de6988ef5efb4db0b0683c9ddc63ad200aa5e88b8f01a9294f1b

Malware Config

Signatures

  • NetFilter

    NetFilter is a rootkit first seen in June 2021.

  • Sets service image path in registry 2 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe.bin.exe"
    1⤵
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\SysWOW64\regini.exe
      "C:\Windows\System32\regini.exe" c.xalm
      2⤵
        PID:3032

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\c.xalm

      MD5

      e4a1a575a3c19abc5ff8fd9f3fece159

      SHA1

      d15d4c436faeb642871c33932da2f31e265d200c

      SHA256

      60c77aa3a588cb9c807d934f0352fbedc9e64046a972f1ad9fdbf229c9158a26

      SHA512

      23f01e80234f19ce071646b978646279bc1d8f883248c405e2e10ac75d8f67fc08d4109fc87a7021ccec3ae083c53e78c62045383d25622115cd05b0e6972fff

    • memory/3032-114-0x0000000000000000-mapping.dmp