d401cecef9371db314f39d5c4bf3457340d7be6f0aac6c61b3cd25310a9dfadf

General

Target
Zsd~reet_02987635367-03987635637.exe
Size 787KB
Sample220117-lfchdahebk
SHA256 d401cecef9371db314f39d5c4bf3457340d7be6f0aac6c61b3cd25310a9dfadf
MD5 110b8fb575591602bc3d793cbe51edde
SHA1 fd18d24771192aca0cb6f200b851f21e88ce63ab
SHA512 9363b1c6e7eda9fb73adbad77197a0a7c095db32d50208dd9241c2bba309833a68143db875d0240eadf717b3dd454a8850ea4759642a36ec2c1738d4226be77d
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1016	rde~aa009765678-987656bn.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rde~aa009765678-987656bn.lnk	Zsd~reet_02987635367-03987635637.exe

Loads dropped DLL 1 IoCs

pid	Process
1556	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
636	PING.EXE
1860	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1504	Zsd~reet_02987635367-03987635637.exe
1504	Zsd~reet_02987635367-03987635637.exe
1504	Zsd~reet_02987635367-03987635637.exe
1504	Zsd~reet_02987635367-03987635637.exe
1016	rde~aa009765678-987656bn.exe
1016	rde~aa009765678-987656bn.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	Zsd~reet_02987635367-03987635637.exe
Token: SeDebugPrivilege	1016	rde~aa009765678-987656bn.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1556	1504	Zsd~reet_02987635367-03987635637.exe	27
PID 1504 wrote to memory of 1556	1504	Zsd~reet_02987635367-03987635637.exe	27
PID 1504 wrote to memory of 1556	1504	Zsd~reet_02987635367-03987635637.exe	27
PID 1504 wrote to memory of 1556	1504	Zsd~reet_02987635367-03987635637.exe	27
PID 1556 wrote to memory of 636	1556	cmd.exe	29
PID 1556 wrote to memory of 636	1556	cmd.exe	29
PID 1556 wrote to memory of 636	1556	cmd.exe	29
PID 1556 wrote to memory of 636	1556	cmd.exe	29
PID 1556 wrote to memory of 1860	1556	cmd.exe	32
PID 1556 wrote to memory of 1860	1556	cmd.exe	32
PID 1556 wrote to memory of 1860	1556	cmd.exe	32
PID 1556 wrote to memory of 1860	1556	cmd.exe	32
PID 1556 wrote to memory of 1016	1556	cmd.exe	33
PID 1556 wrote to memory of 1016	1556	cmd.exe	33
PID 1556 wrote to memory of 1016	1556	cmd.exe	33
PID 1556 wrote to memory of 1016	1556	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\Zsd~reet_02987635367-03987635637.exe
"C:\Users\Admin\AppData\Local\Temp\Zsd~reet_02987635367-03987635637.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 42 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Zsd~reet_02987635367-03987635637.exe" "C:\Users\Admin\Favorites\rde~aa009765678-987656bn.exe" && ping 127.0.0.1 -n 42 > nul && "C:\Users\Admin\Favorites\rde~aa009765678-987656bn.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 42
    3⤵
    - Runs ping.exe
    PID:636
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 42
    3⤵
    - Runs ping.exe
    PID:1860
- - C:\Users\Admin\Favorites\rde~aa009765678-987656bn.exe
    "C:\Users\Admin\Favorites\rde~aa009765678-987656bn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-66-0x0000000000360000-0x000000000042A000-memory.dmp

Download

memory/1016-67-0x0000000000360000-0x000000000042A000-memory.dmp

Download

memory/1016-68-0x0000000000330000-0x0000000000362000-memory.dmp

Download

memory/1016-69-0x0000000000520000-0x0000000000536000-memory.dmp

Download

memory/1016-70-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download

memory/1504-58-0x00000000047F0000-0x00000000047F1000-memory.dmp

Download

memory/1504-57-0x0000000000320000-0x0000000000336000-memory.dmp

Download

memory/1504-56-0x00000000002A0000-0x00000000002D2000-memory.dmp

Download

memory/1504-55-0x0000000000030000-0x00000000000FA000-memory.dmp

Download

memory/1504-54-0x0000000000030000-0x00000000000FA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads