1bd4fe07daaeb321a120cfbd1d02fdfefc2dae30b4dfa50adff0f85939d88792

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-en-20210920
submitted
24-09-2021 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe
Size

851KB
MD5

d711578ec74c9394de520aedae7effb5
SHA1

42d8823cb39ace83f004c73971fd435b786b9f5b
SHA256

79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361
SHA512

af8f03c93f5beec894091d429cb0c6df33101eab96e6ef0fde527307206267de2644f479cef5c3e7354791bb12dd7418bfcdeaea9beb509c92a6bff195e2f06a

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

zeronet-downloader.exe

pid process

972 zeronet-downloader.exe

pid	process
972	zeronet-downloader.exe

Loads dropped DLL 3 IoCs

Processes:

79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe

pid	process
1348	79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe
1348	79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe
1204

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe

pid process

1348 79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe

description	pid	process	target process
PID 1348 wrote to memory of 972	1348	79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe	zeronet-downloader.exe
PID 1348 wrote to memory of 972	1348	79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe	zeronet-downloader.exe
PID 1348 wrote to memory of 972	1348	79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe	zeronet-downloader.exe

C:\Users\Admin\AppData\Local\Temp\79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe
"C:\Users\Admin\AppData\Local\Temp\79b2065107cb362001a2f8a8cd8e2e20678b2eb2c0372ef760495d9fff407361.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe
"C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe"
2⤵
- Executes dropped EXE
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe
MD5
9e0722e16793b9e6ffd8b48f4033a236

SHA1
b76ebcc61e0d16a93feca87525966d0c4f571ec3

SHA256
b5782642408eb1aa19df1781e8de277e0f586f66632b3171069630651c11e988

SHA512
f12b277330eeac8e04d3d5b69b37c690897fc49c6586e4ec9c5aa412cd64c07fd9c4edfe6607d01fa49ec6efb3d594af6277555ce70cf0d970d1c29ef5f04bd9

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe
MD5
9e0722e16793b9e6ffd8b48f4033a236

SHA1
b76ebcc61e0d16a93feca87525966d0c4f571ec3

SHA256
b5782642408eb1aa19df1781e8de277e0f586f66632b3171069630651c11e988

SHA512
f12b277330eeac8e04d3d5b69b37c690897fc49c6586e4ec9c5aa412cd64c07fd9c4edfe6607d01fa49ec6efb3d594af6277555ce70cf0d970d1c29ef5f04bd9

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe
MD5
9e0722e16793b9e6ffd8b48f4033a236

SHA1
b76ebcc61e0d16a93feca87525966d0c4f571ec3

SHA256
b5782642408eb1aa19df1781e8de277e0f586f66632b3171069630651c11e988

SHA512
f12b277330eeac8e04d3d5b69b37c690897fc49c6586e4ec9c5aa412cd64c07fd9c4edfe6607d01fa49ec6efb3d594af6277555ce70cf0d970d1c29ef5f04bd9

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe
MD5
9e0722e16793b9e6ffd8b48f4033a236

SHA1
b76ebcc61e0d16a93feca87525966d0c4f571ec3

SHA256
b5782642408eb1aa19df1781e8de277e0f586f66632b3171069630651c11e988

SHA512
f12b277330eeac8e04d3d5b69b37c690897fc49c6586e4ec9c5aa412cd64c07fd9c4edfe6607d01fa49ec6efb3d594af6277555ce70cf0d970d1c29ef5f04bd9

Download Submit
memory/972-57-0x0000000000000000-mapping.dmp

Download
memory/1348-54-0x000007FEFBFD1000-0x000007FEFBFD3000-memory.dmp

Filesize
8KB

Download