Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
19-03-2022 07:12
Static task
static1
Behavioral task
behavioral1
Sample
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe
Resource
win7-20220311-en
General
-
Target
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe
-
Size
565KB
-
MD5
cb767cd30e2fc7e8e12c27b4e8a5d367
-
SHA1
f94c105aacfcccc356cad7b8fe631cb27b3e6c20
-
SHA256
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35
-
SHA512
9087f912a06e6ae980225d1e31b249300e1ae88dd8a6e66ccd5747770a3f9127ea63e7a9dbd0090cb581c67ad8911de575f8852fe8fac76f36c47529f8a8b4d2
Malware Config
Signatures
-
DarkVNC Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1936-135-0x0000000000450000-0x00000000004D9000-memory.dmp darkvnc behavioral2/memory/4296-142-0x00000192118F0000-0x00000192119B9000-memory.dmp darkvnc -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exedescription pid process target process PID 1936 set thread context of 4296 1936 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4940 1936 WerFault.exe a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exepid process 1936 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exepid process 1936 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exedescription pid process target process PID 1936 wrote to memory of 4296 1936 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1936 wrote to memory of 4296 1936 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1936 wrote to memory of 4296 1936 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1936 wrote to memory of 4296 1936 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe PID 1936 wrote to memory of 4296 1936 a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe"C:\Users\Admin\AppData\Local\Temp\a8b945595d20c4157464b57a7bf665e8b8d3df060018ef06e87b4d03bbbffb35.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 4642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1936 -ip 19361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1936-130-0x0000000004930000-0x0000000004983000-memory.dmpFilesize
332KB
-
memory/1936-131-0x00000000049A0000-0x0000000004A13000-memory.dmpFilesize
460KB
-
memory/1936-132-0x0000000000400000-0x00000000047F9000-memory.dmpFilesize
68.0MB
-
memory/1936-133-0x0000000000400000-0x00000000047F9000-memory.dmpFilesize
68.0MB
-
memory/1936-135-0x0000000000450000-0x00000000004D9000-memory.dmpFilesize
548KB
-
memory/1936-137-0x0000000000400000-0x00000000047F9000-memory.dmpFilesize
68.0MB
-
memory/1936-139-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1936-140-0x0000000000400000-0x00000000047F9000-memory.dmpFilesize
68.0MB
-
memory/1936-141-0x0000000000400000-0x00000000047F9000-memory.dmpFilesize
68.0MB
-
memory/4296-138-0x0000019211870000-0x0000019211871000-memory.dmpFilesize
4KB
-
memory/4296-142-0x00000192118F0000-0x00000192119B9000-memory.dmpFilesize
804KB