Analysis
-
max time kernel
4294179s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
14-04-2022 14:11
Static task
static1
Behavioral task
behavioral1
Sample
1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
General
-
Target
1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe
-
Size
858KB
-
MD5
c2b6fbbc4fcda94fe3eb98afb72f8263
-
SHA1
040ec98f152d0debfaa703cc1e055108da415fbc
-
SHA256
1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5
-
SHA512
f539dc223290b2112c68511624ca59d9d60d3984796fe090f41f1149202fa74c9dd135725eefede18b35442215692109a039e6e7a078d1278f99a075e170deb0
Malware Config
Extracted
Family
buer
C2
https://gpsdrlow.net/
Signatures
-
resource yara_rule behavioral1/memory/432-58-0x0000000040000000-0x000000004000C000-memory.dmp buer behavioral1/memory/432-61-0x0000000040000000-0x000000004000C000-memory.dmp buer behavioral1/memory/432-64-0x0000000040000000-0x000000004000C000-memory.dmp buer -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\webmail.exe DllHost.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\J: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\L: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\W: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\Z: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\A: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\E: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\M: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\O: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\R: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\S: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\V: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\F: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\G: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\H: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\N: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\P: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\Q: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\U: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\Y: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\B: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\K: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\T: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe File opened (read-only) \??\X: 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 1984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1984 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 1584 wrote to memory of 432 1584 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 30 PID 432 wrote to memory of 1984 432 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 31 PID 432 wrote to memory of 1984 432 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 31 PID 432 wrote to memory of 1984 432 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 31 PID 432 wrote to memory of 1984 432 1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe"C:\Users\Admin\AppData\Local\Temp\1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe"C:\Users\Admin\AppData\Local\Temp\1884d4a7e597fe560258585106a474c464659864a51ccd6ecd0e245409594dc5.exe"2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& {Add-MpPreference -ExclusionPath C:\ProgramData\50102f6ae4ce2e3956ba}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:336