237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85

Resubmissions

19/01/2022, 16:34

220119-t3b45abecp10

25/11/2021, 12:36

211125-psysxsfbgp8

Analysis

max time kernel
112s
max time network
128s
platform
windows10_x64
resource
win10-en-20211014
submitted
25/11/2021, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe
Size 5.0MB
Sample211125-psysxsfbgp
SHA256 237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85
MD5 1b010600ba6e9288ba1de8456a1d9261
SHA1 24a7a32d9d4944fc2e9bc89867ef682ffe4b6e5d
SHA512 9ae6b04515f566a52f5e5d17d2e573ca388a5c0ac3a110ff3e3fb8c8a9761af8058e3959f203c3aae6937084fc4a28027168782c462bf9da83c74103f794463a
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2276	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp
2660	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp
1052	evreporter.exe

Loads dropped DLL 1 IoCs

pid	Process
1052	evreporter.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2660	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp
2660	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2660	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2276	2764	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe	68
PID 2764 wrote to memory of 2276	2764	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe	68
PID 2764 wrote to memory of 2276	2764	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe	68
PID 2276 wrote to memory of 1956	2276	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp	69
PID 2276 wrote to memory of 1956	2276	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp	69
PID 2276 wrote to memory of 1956	2276	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp	69
PID 1956 wrote to memory of 2660	1956	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe	70
PID 1956 wrote to memory of 2660	1956	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe	70
PID 1956 wrote to memory of 2660	1956	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe	70
PID 2660 wrote to memory of 1052	2660	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp	71
PID 2660 wrote to memory of 1052	2660	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp	71
PID 2660 wrote to memory of 1052	2660	237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp	71

C:\Users\Admin\AppData\Local\Temp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe
"C:\Users\Admin\AppData\Local\Temp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\is-O2LJ6.tmp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O2LJ6.tmp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp" /SL5="$301CC,4382530,831488,C:\Users\Admin\AppData\Local\Temp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Users\Admin\AppData\Local\Temp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe
    "C:\Users\Admin\AppData\Local\Temp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe" /VERYSILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\is-5UGR2.tmp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-5UGR2.tmp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.tmp" /SL5="$401CC,4382530,831488,C:\Users\Admin\AppData\Local\Temp\237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe
        
        "C:\Users\Admin\AppData\Roaming\Ev Reports Management\evreporter.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-126-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2276-120-0x0000000000720000-0x00000000007CE000-memory.dmp

Download

memory/2660-127-0x0000000000840000-0x0000000000841000-memory.dmp

Download

memory/2764-117-0x0000000000400000-0x00000000004D8000-memory.dmp

Download