Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en -
submitted
10-09-2021 02:02
Static task
static1
Behavioral task
behavioral1
Sample
26944aed6dfc2c25f96bbca49925fcaf.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
26944aed6dfc2c25f96bbca49925fcaf.exe
Resource
win7-en
Behavioral task
behavioral3
Sample
26944aed6dfc2c25f96bbca49925fcaf.exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
26944aed6dfc2c25f96bbca49925fcaf.exe
Resource
win10-jp
General
-
Target
26944aed6dfc2c25f96bbca49925fcaf.exe
-
Size
3.9MB
-
MD5
26944aed6dfc2c25f96bbca49925fcaf
-
SHA1
b2b7a7a659abf7fd2c5596c119478363e0b7f360
-
SHA256
64dd547546394e1d431a25a671892c7aca9cf57ed0733a7435028792ad42f4a7
-
SHA512
ea0a599107acfbca4cc20987d003bd27a3168adea1df56378d4b6a934d1429d543bec91a7216c485ec0167b1d34ed510299e030944c4b8f6c3922b4699a4eabf
Malware Config
Extracted
rustybuer
https://awmelisers.com/
Signatures
-
Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: secinit.exe File opened (read-only) \??\T: secinit.exe File opened (read-only) \??\g: secinit.exe File opened (read-only) \??\i: secinit.exe File opened (read-only) \??\j: secinit.exe File opened (read-only) \??\n: secinit.exe File opened (read-only) \??\N: secinit.exe File opened (read-only) \??\O: secinit.exe File opened (read-only) \??\Z: secinit.exe File opened (read-only) \??\G: secinit.exe File opened (read-only) \??\m: secinit.exe File opened (read-only) \??\q: secinit.exe File opened (read-only) \??\M: secinit.exe File opened (read-only) \??\r: secinit.exe File opened (read-only) \??\B: secinit.exe File opened (read-only) \??\E: secinit.exe File opened (read-only) \??\h: secinit.exe File opened (read-only) \??\H: secinit.exe File opened (read-only) \??\k: secinit.exe File opened (read-only) \??\L: secinit.exe File opened (read-only) \??\t: secinit.exe File opened (read-only) \??\u: secinit.exe File opened (read-only) \??\U: secinit.exe File opened (read-only) \??\x: secinit.exe File opened (read-only) \??\Y: secinit.exe File opened (read-only) \??\a: secinit.exe File opened (read-only) \??\F: secinit.exe File opened (read-only) \??\w: secinit.exe File opened (read-only) \??\e: secinit.exe File opened (read-only) \??\I: secinit.exe File opened (read-only) \??\o: secinit.exe File opened (read-only) \??\v: secinit.exe File opened (read-only) \??\z: secinit.exe File opened (read-only) \??\K: secinit.exe File opened (read-only) \??\P: secinit.exe File opened (read-only) \??\s: secinit.exe File opened (read-only) \??\X: secinit.exe File opened (read-only) \??\D: secinit.exe File opened (read-only) \??\f: secinit.exe File opened (read-only) \??\J: secinit.exe File opened (read-only) \??\p: secinit.exe File opened (read-only) \??\y: secinit.exe File opened (read-only) \??\W: secinit.exe File opened (read-only) \??\A: secinit.exe File opened (read-only) \??\b: secinit.exe File opened (read-only) \??\l: secinit.exe File opened (read-only) \??\R: secinit.exe File opened (read-only) \??\S: secinit.exe File opened (read-only) \??\V: secinit.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 736 set thread context of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1524 secinit.exe 1524 secinit.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30 PID 736 wrote to memory of 1524 736 26944aed6dfc2c25f96bbca49925fcaf.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\26944aed6dfc2c25f96bbca49925fcaf.exe"C:\Users\Admin\AppData\Local\Temp\26944aed6dfc2c25f96bbca49925fcaf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\secinit.exe"C:\Windows\System32\secinit.exe"2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:1524
-