dbf0fff8619800b75efb046b9028d1bfca9e7fa079f65a4b83d18773df15f787

General

Target

Waybill.exe
Size

723KB
MD5

09b9b6539a59827caae00b06080ad282
SHA1

caf0989bf05e05c6a1a71e3b4c8ae10603ef5b76
SHA256

dbf0fff8619800b75efb046b9028d1bfca9e7fa079f65a4b83d18773df15f787
SHA512

c6abe7020e437a774c4a7d1838f401495af5704378dcef3fa6147c0f3648ef5b4d942c8c9b6f881515017e1ce26094016dcc1825f9e4cf61b7232541c27a0a8f

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Waybill.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Furleet = "C:\\Users\\Public\\Libraries\\teelruF.url"	Waybill.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1960 1092 WerFault.exe dialer.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1960 WerFault.exe
1960 WerFault.exe
1960 WerFault.exe
1960 WerFault.exe
1960 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1960 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1960 WerFault.exe

pid	pid_target	process	target process
1960	1092	WerFault.exe	dialer.exe

pid	process
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe
1960	WerFault.exe

pid	process
1960	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1960	WerFault.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Waybill.exedialer.exe

description	pid	process	target process
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1820 wrote to memory of 1092	1820	Waybill.exe	dialer.exe
PID 1092 wrote to memory of 1960	1092	dialer.exe	WerFault.exe
PID 1092 wrote to memory of 1960	1092	dialer.exe	WerFault.exe
PID 1092 wrote to memory of 1960	1092	dialer.exe	WerFault.exe
PID 1092 wrote to memory of 1960	1092	dialer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Waybill.exe
"C:\Users\Admin\AppData\Local\Temp\Waybill.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\dialer.exe
C:\Windows\System32\dialer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 152
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-65-0x0000000000000000-mapping.dmp

Download
memory/1092-72-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1092-71-0x0000000010540000-0x0000000010563000-memory.dmp

Filesize
140KB

Download
memory/1092-70-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1092-69-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1820-60-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1820-64-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/1960-67-0x0000000000000000-mapping.dmp

Download
memory/1960-73-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing