Analysis
-
max time kernel
165s -
max time network
209s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-05-2022 18:15
Static task
static1
Behavioral task
behavioral1
Sample
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe
Resource
win10v2004-20220414-en
General
-
Target
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe
-
Size
5.9MB
-
MD5
390631e07e9b222c486f6c09fb4d007e
-
SHA1
bd4ce4a8eeef7effad15dcdf704e9ad8f8a4de1f
-
SHA256
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2
-
SHA512
bfb68feca7437efd05b3d1d6f7549573e63ac2e99d854186b90aaafec6ae070e56e06533cb7a708279bb0b3883c341ae7a9fa52a12198831836ff30826ea8cde
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
regasm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\IcXbKe4p02dHqi5S\\gv3VCLzcpXhv.exe\",explorer.exe" regasm.exe -
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/776-121-0x0000000000400000-0x00000000005F7000-memory.dmp family_webmonitor behavioral1/memory/776-122-0x0000000000400000-0x00000000005F7000-memory.dmp family_webmonitor -
Executes dropped EXE 1 IoCs
Processes:
Machinery64.exepid process 576 Machinery64.exe -
Processes:
resource yara_rule behavioral1/memory/776-111-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/776-113-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/776-114-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/776-117-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/776-116-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/776-120-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/776-121-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral1/memory/776-122-0x0000000000400000-0x00000000005F7000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exeWerFault.exepid process 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe 328 WerFault.exe 328 WerFault.exe 328 WerFault.exe 328 WerFault.exe 328 WerFault.exe -
Unexpected DNS network traffic destination 7 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 114.114.114.114 Destination IP 185.243.215.214 Destination IP 1.2.4.8 Destination IP 185.243.215.214 Destination IP 1.2.4.8 Destination IP 185.243.215.214 Destination IP 114.114.114.114 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exeregasm.exedescription pid process target process PID 960 set thread context of 1196 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 1196 set thread context of 776 1196 regasm.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 328 576 WerFault.exe Machinery64.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regasm.exepid process 1196 regasm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exepid process 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
regasm.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 1196 regasm.exe Token: SeDebugPrivilege 776 AppLaunch.exe Token: SeShutdownPrivilege 776 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exepid process 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exeMachinery64.exeregasm.exedescription pid process target process PID 960 wrote to memory of 576 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe Machinery64.exe PID 960 wrote to memory of 576 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe Machinery64.exe PID 960 wrote to memory of 576 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe Machinery64.exe PID 960 wrote to memory of 576 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe Machinery64.exe PID 960 wrote to memory of 1196 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 960 wrote to memory of 1196 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 960 wrote to memory of 1196 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 960 wrote to memory of 1196 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 960 wrote to memory of 1196 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 960 wrote to memory of 1196 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 960 wrote to memory of 1196 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 960 wrote to memory of 1196 960 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 576 wrote to memory of 328 576 Machinery64.exe WerFault.exe PID 576 wrote to memory of 328 576 Machinery64.exe WerFault.exe PID 576 wrote to memory of 328 576 Machinery64.exe WerFault.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe PID 1196 wrote to memory of 776 1196 regasm.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe"C:\Users\Admin\AppData\Local\Temp\e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Machinery64.exe"C:\Users\Admin\AppData\Local\Temp\Machinery64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 576 -s 4763⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
C:\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
memory/328-103-0x0000000000000000-mapping.dmp
-
memory/576-100-0x000000013FD30000-0x00000001401B2000-memory.dmpFilesize
4.5MB
-
memory/576-94-0x0000000000000000-mapping.dmp
-
memory/776-116-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/776-110-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/776-111-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/776-113-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/776-114-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/776-115-0x00000000005F5A70-mapping.dmp
-
memory/776-117-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/776-120-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/776-121-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/776-122-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/776-123-0x0000000002A30000-0x0000000003A30000-memory.dmpFilesize
16.0MB
-
memory/960-74-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-56-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-57-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-98-0x0000000002AF0000-0x0000000002AF8000-memory.dmpFilesize
32KB
-
memory/960-59-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-92-0x0000000000B7E000-0x0000000000B83000-memory.dmpFilesize
20KB
-
memory/960-91-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/960-89-0x0000000000B7E000-0x0000000000B83000-memory.dmpFilesize
20KB
-
memory/960-83-0x0000000000B7E000-0x0000000000B83000-memory.dmpFilesize
20KB
-
memory/960-62-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-77-0x0000000000B7E000-0x0000000000B83000-memory.dmpFilesize
20KB
-
memory/960-63-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-72-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-71-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-69-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-68-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/960-65-0x0000000000B88000-0x0000000000B8B000-memory.dmpFilesize
12KB
-
memory/1196-101-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/1196-109-0x0000000000AA6000-0x0000000000AB7000-memory.dmpFilesize
68KB
-
memory/1196-97-0x00000000004E698E-mapping.dmp
-
memory/1196-102-0x0000000073BC0000-0x000000007416B000-memory.dmpFilesize
5.7MB