Analysis
-
max time kernel
241s -
max time network
271s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
20-08-2021 15:35
Static task
static1
Behavioral task
behavioral1
Sample
hypovitaminosis.db.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
hypovitaminosis.db.exe
-
Size
3.9MB
-
MD5
26944aed6dfc2c25f96bbca49925fcaf
-
SHA1
b2b7a7a659abf7fd2c5596c119478363e0b7f360
-
SHA256
64dd547546394e1d431a25a671892c7aca9cf57ed0733a7435028792ad42f4a7
-
SHA512
ea0a599107acfbca4cc20987d003bd27a3168adea1df56378d4b6a934d1429d543bec91a7216c485ec0167b1d34ed510299e030944c4b8f6c3922b4699a4eabf
Malware Config
Extracted
Family
rustybuer
C2
https://awmelisers.com/
Signatures
-
Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\w: secinit.exe File opened (read-only) \??\E: secinit.exe File opened (read-only) \??\f: secinit.exe File opened (read-only) \??\G: secinit.exe File opened (read-only) \??\k: secinit.exe File opened (read-only) \??\O: secinit.exe File opened (read-only) \??\P: secinit.exe File opened (read-only) \??\r: secinit.exe File opened (read-only) \??\x: secinit.exe File opened (read-only) \??\Z: secinit.exe File opened (read-only) \??\b: secinit.exe File opened (read-only) \??\e: secinit.exe File opened (read-only) \??\R: secinit.exe File opened (read-only) \??\u: secinit.exe File opened (read-only) \??\X: secinit.exe File opened (read-only) \??\j: secinit.exe File opened (read-only) \??\m: secinit.exe File opened (read-only) \??\M: secinit.exe File opened (read-only) \??\v: secinit.exe File opened (read-only) \??\Y: secinit.exe File opened (read-only) \??\V: secinit.exe File opened (read-only) \??\F: secinit.exe File opened (read-only) \??\i: secinit.exe File opened (read-only) \??\K: secinit.exe File opened (read-only) \??\L: secinit.exe File opened (read-only) \??\n: secinit.exe File opened (read-only) \??\o: secinit.exe File opened (read-only) \??\t: secinit.exe File opened (read-only) \??\y: secinit.exe File opened (read-only) \??\B: secinit.exe File opened (read-only) \??\D: secinit.exe File opened (read-only) \??\g: secinit.exe File opened (read-only) \??\N: secinit.exe File opened (read-only) \??\T: secinit.exe File opened (read-only) \??\U: secinit.exe File opened (read-only) \??\W: secinit.exe File opened (read-only) \??\a: secinit.exe File opened (read-only) \??\h: secinit.exe File opened (read-only) \??\J: secinit.exe File opened (read-only) \??\p: secinit.exe File opened (read-only) \??\I: secinit.exe File opened (read-only) \??\Q: secinit.exe File opened (read-only) \??\S: secinit.exe File opened (read-only) \??\z: secinit.exe File opened (read-only) \??\A: secinit.exe File opened (read-only) \??\H: secinit.exe File opened (read-only) \??\l: secinit.exe File opened (read-only) \??\q: secinit.exe File opened (read-only) \??\s: secinit.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1648 set thread context of 1624 1648 hypovitaminosis.db.exe 29 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1624 secinit.exe 1624 secinit.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29 PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29 PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29 PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29 PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29 PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29 PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29 PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29 PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29 PID 1648 wrote to memory of 1624 1648 hypovitaminosis.db.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\hypovitaminosis.db.exe"C:\Users\Admin\AppData\Local\Temp\hypovitaminosis.db.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\secinit.exe"C:\Windows\System32\secinit.exe"2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:1624
-