Analysis
-
max time kernel
135s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 00:05
Static task
static1
Behavioral task
behavioral1
Sample
Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
Resource
win7-en-20211208
General
-
Target
Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe
-
Size
207KB
-
MD5
d8cbee400f429451d895c0fa516fbec2
-
SHA1
e55216848d4b41e0f34b8411d63353e7dee8a999
-
SHA256
964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56
-
SHA512
6e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975
Malware Config
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1492-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1492-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1492-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1492-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1788-83-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
DriiveUpdate.exeDriiveUpdate.exepid process 2032 DriiveUpdate.exe 1788 DriiveUpdate.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exeDriiveUpdate.exepid process 456 cmd.exe 2032 DriiveUpdate.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDriiveUpdate.exedescription pid process target process PID 1276 set thread context of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 2032 set thread context of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 824 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDocumento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDriiveUpdate.exepid process 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe 2032 DriiveUpdate.exe 2032 DriiveUpdate.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDocumento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDriiveUpdate.exeDriiveUpdate.exedescription pid process Token: SeDebugPrivilege 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Token: SeDebugPrivilege 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Token: SeDebugPrivilege 2032 DriiveUpdate.exe Token: SeDebugPrivilege 1788 DriiveUpdate.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exeDocumento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.execmd.execmd.exeDriiveUpdate.exedescription pid process target process PID 1276 wrote to memory of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 1276 wrote to memory of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 1276 wrote to memory of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 1276 wrote to memory of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 1276 wrote to memory of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 1276 wrote to memory of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 1276 wrote to memory of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 1276 wrote to memory of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 1276 wrote to memory of 1492 1276 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe PID 1492 wrote to memory of 1100 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe cmd.exe PID 1492 wrote to memory of 1100 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe cmd.exe PID 1492 wrote to memory of 1100 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe cmd.exe PID 1492 wrote to memory of 1100 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe cmd.exe PID 1492 wrote to memory of 456 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe cmd.exe PID 1492 wrote to memory of 456 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe cmd.exe PID 1492 wrote to memory of 456 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe cmd.exe PID 1492 wrote to memory of 456 1492 Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe cmd.exe PID 456 wrote to memory of 824 456 cmd.exe timeout.exe PID 456 wrote to memory of 824 456 cmd.exe timeout.exe PID 456 wrote to memory of 824 456 cmd.exe timeout.exe PID 456 wrote to memory of 824 456 cmd.exe timeout.exe PID 1100 wrote to memory of 2024 1100 cmd.exe schtasks.exe PID 1100 wrote to memory of 2024 1100 cmd.exe schtasks.exe PID 1100 wrote to memory of 2024 1100 cmd.exe schtasks.exe PID 1100 wrote to memory of 2024 1100 cmd.exe schtasks.exe PID 456 wrote to memory of 2032 456 cmd.exe DriiveUpdate.exe PID 456 wrote to memory of 2032 456 cmd.exe DriiveUpdate.exe PID 456 wrote to memory of 2032 456 cmd.exe DriiveUpdate.exe PID 456 wrote to memory of 2032 456 cmd.exe DriiveUpdate.exe PID 456 wrote to memory of 2032 456 cmd.exe DriiveUpdate.exe PID 456 wrote to memory of 2032 456 cmd.exe DriiveUpdate.exe PID 456 wrote to memory of 2032 456 cmd.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe PID 2032 wrote to memory of 1788 2032 DriiveUpdate.exe DriiveUpdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe"C:\Users\Admin\AppData\Local\Temp\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe"C:\Users\Admin\AppData\Local\Temp\Documento_99807_40806_2022_consulta_procesos_ramajudicial_fallo_en_sugunda_intacionPdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "DriiveUpdate" /tr '"C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "DriiveUpdate" /tr '"C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4569.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"C:\Users\Admin\AppData\Roaming\DriiveUpdate.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4569.tmp.batMD5
87213a357f0c3eb60534a8c681f7a454
SHA158a57be30343d9a73281a6f49a9f311b0206e8e4
SHA25623dce8200139cc8acde7ed3c93327ac38cfebf8cd34122804922d5973b2ca10e
SHA512ee5cf1f6fdcda38c4e984e3712412255f1695ee5ac1f22790799962ea028129f366bb6be3584669d826e4d3b24be6024930ad8bf04329ad15a0ccf30ea6af353
-
C:\Users\Admin\AppData\Roaming\DriiveUpdate.exeMD5
d8cbee400f429451d895c0fa516fbec2
SHA1e55216848d4b41e0f34b8411d63353e7dee8a999
SHA256964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56
SHA5126e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975
-
C:\Users\Admin\AppData\Roaming\DriiveUpdate.exeMD5
d8cbee400f429451d895c0fa516fbec2
SHA1e55216848d4b41e0f34b8411d63353e7dee8a999
SHA256964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56
SHA5126e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975
-
C:\Users\Admin\AppData\Roaming\DriiveUpdate.exeMD5
d8cbee400f429451d895c0fa516fbec2
SHA1e55216848d4b41e0f34b8411d63353e7dee8a999
SHA256964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56
SHA5126e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975
-
\Users\Admin\AppData\Roaming\DriiveUpdate.exeMD5
d8cbee400f429451d895c0fa516fbec2
SHA1e55216848d4b41e0f34b8411d63353e7dee8a999
SHA256964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56
SHA5126e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975
-
\Users\Admin\AppData\Roaming\DriiveUpdate.exeMD5
d8cbee400f429451d895c0fa516fbec2
SHA1e55216848d4b41e0f34b8411d63353e7dee8a999
SHA256964206c347c4b90e09c56fe2b42792eef1115caae55e6216a533bd8a3f3a5d56
SHA5126e51c319ec5671effb87276f58b5a02a52e8959c38b300f94db9c8b342d4bc86fe0b9f3c806ab1770fdcae91710236a05719f44e4bfdb57993525afafb8d0975
-
memory/1276-56-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB
-
memory/1276-57-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/1276-58-0x0000000000640000-0x000000000064C000-memory.dmpFilesize
48KB
-
memory/1276-59-0x0000000000BD0000-0x0000000000C08000-memory.dmpFilesize
224KB
-
memory/1276-55-0x0000000000D60000-0x0000000000D9A000-memory.dmpFilesize
232KB
-
memory/1492-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-67-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/1492-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1788-83-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1788-85-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/2032-72-0x0000000000E50000-0x0000000000E8A000-memory.dmpFilesize
232KB
-
memory/2032-74-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/2032-75-0x0000000000720000-0x0000000000758000-memory.dmpFilesize
224KB