netfilter | cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce

Analysis

Target

cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe
Size

114KB
MD5

400c1c6312f99e4640077994bbfaedde
SHA1

657a875554b075eb7f2d314bbbe967c789624b30
SHA256

cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce
SHA512

00b05036757e558c3d210f838dce3c8b2b4808655263cc1d69bf21a78e93f6ad52b6a20a4d68ac033fdf06eecc334690190f38e8435dc64fab3d64b7fc1d5c96

Score

10^/10

NetFilter
NetFilter is a rootkit first seen in June 2021.
rootkit netfilter
Downloads MZ/PE file
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe

pid process

788 cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe

description pid process

Token: SeLoadDriverPrivilege 788 cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe

pid	process
788	cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe

description	pid	process
Token: SeLoadDriverPrivilege	788	cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe

description	pid	process	target process
PID 788 wrote to memory of 1580	788	cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe	regini.exe
PID 788 wrote to memory of 1580	788	cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe	regini.exe
PID 788 wrote to memory of 1580	788	cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe	regini.exe
PID 788 wrote to memory of 1580	788	cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe	regini.exe

C:\Users\Admin\AppData\Local\Temp\cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe
"C:\Users\Admin\AppData\Local\Temp\cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin.exe"
1⤵
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\regini.exe
  "C:\Windows\System32\regini.exe" configure.xalm
  2⤵
  PID:1580

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\configure.xalm

MD5
e4a1a575a3c19abc5ff8fd9f3fece159

SHA1
d15d4c436faeb642871c33932da2f31e265d200c

SHA256
60c77aa3a588cb9c807d934f0352fbedc9e64046a972f1ad9fdbf229c9158a26

SHA512
23f01e80234f19ce071646b978646279bc1d8f883248c405e2e10ac75d8f67fc08d4109fc87a7021ccec3ae083c53e78c62045383d25622115cd05b0e6972fff

Download Submit
memory/788-60-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download
memory/1580-61-0x0000000000000000-mapping.dmp

Download