Analysis
-
max time kernel
155s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-05-2022 18:15
Static task
static1
Behavioral task
behavioral1
Sample
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe
Resource
win10v2004-20220414-en
General
-
Target
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe
-
Size
5.9MB
-
MD5
390631e07e9b222c486f6c09fb4d007e
-
SHA1
bd4ce4a8eeef7effad15dcdf704e9ad8f8a4de1f
-
SHA256
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2
-
SHA512
bfb68feca7437efd05b3d1d6f7549573e63ac2e99d854186b90aaafec6ae070e56e06533cb7a708279bb0b3883c341ae7a9fa52a12198831836ff30826ea8cde
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
regasm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\IcXbKe4p02dHqi5S\\N6cTL1nZ7yVU.exe\",explorer.exe" regasm.exe -
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4516-173-0x0000000000400000-0x00000000005F7000-memory.dmp family_webmonitor behavioral2/memory/4516-174-0x0000000000400000-0x00000000005F7000-memory.dmp family_webmonitor -
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
-
Executes dropped EXE 1 IoCs
Processes:
Machinery64.exepid process 4632 Machinery64.exe -
Processes:
resource yara_rule behavioral2/memory/4516-170-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral2/memory/4516-171-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral2/memory/4516-172-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral2/memory/4516-173-0x0000000000400000-0x00000000005F7000-memory.dmp upx behavioral2/memory/4516-174-0x0000000000400000-0x00000000005F7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe -
Unexpected DNS network traffic destination 19 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 114.114.114.114 Destination IP 185.243.215.214 Destination IP 114.114.114.114 Destination IP 1.2.4.8 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 185.243.215.214 Destination IP 114.114.114.114 Destination IP 1.2.4.8 Destination IP 185.243.215.214 Destination IP 185.243.215.214 Destination IP 1.2.4.8 Destination IP 1.2.4.8 Destination IP 1.2.4.8 Destination IP 185.243.215.214 Destination IP 114.114.114.114 Destination IP 1.2.4.8 Destination IP 185.243.215.214 Destination IP 185.243.215.214 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exeregasm.exedescription pid process target process PID 2064 set thread context of 4840 2064 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 4840 set thread context of 4516 4840 regasm.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1672 4632 WerFault.exe Machinery64.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regasm.exepid process 4840 regasm.exe 4840 regasm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exepid process 2064 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
regasm.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 4840 regasm.exe Token: SeDebugPrivilege 4516 AppLaunch.exe Token: SeShutdownPrivilege 4516 AppLaunch.exe Token: SeCreatePagefilePrivilege 4516 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exepid process 2064 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exeregasm.exedescription pid process target process PID 2064 wrote to memory of 4632 2064 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe Machinery64.exe PID 2064 wrote to memory of 4632 2064 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe Machinery64.exe PID 2064 wrote to memory of 4840 2064 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 2064 wrote to memory of 4840 2064 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 2064 wrote to memory of 4840 2064 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 2064 wrote to memory of 4840 2064 e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe regasm.exe PID 4840 wrote to memory of 4516 4840 regasm.exe AppLaunch.exe PID 4840 wrote to memory of 4516 4840 regasm.exe AppLaunch.exe PID 4840 wrote to memory of 4516 4840 regasm.exe AppLaunch.exe PID 4840 wrote to memory of 4516 4840 regasm.exe AppLaunch.exe PID 4840 wrote to memory of 4516 4840 regasm.exe AppLaunch.exe PID 4840 wrote to memory of 4516 4840 regasm.exe AppLaunch.exe PID 4840 wrote to memory of 4516 4840 regasm.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe"C:\Users\Admin\AppData\Local\Temp\e8bde67605e6f54c71e889036fb6fd1d301438aa2f93447eab9f3de8780dbcb2.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Machinery64.exe"C:\Users\Admin\AppData\Local\Temp\Machinery64.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4632 -s 6643⤵
- Program crash
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 404 -p 4632 -ip 46321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
C:\Users\Admin\AppData\Local\Temp\Machinery64.exeFilesize
4.5MB
MD5bbfa4c1e5d3d0620c79d3cd29be4426c
SHA139d2a27c90b7c1229741e97334772d694ade6d51
SHA2569bb6c7fd4c79297c4eb41faf7f9a05bf056b1016d23386835057b800d27d297f
SHA512eea9a51b86251ae44175698341184b824a1397f7b7702f958dc807eac48955188e6c65b887eada1d3f83bf338f4d0db22e25a4bc75b3f921e756a51a75a2177b
-
memory/2064-153-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-142-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-136-0x0000000000D2B000-0x0000000000D2F000-memory.dmpFilesize
16KB
-
memory/2064-134-0x0000000000D2B000-0x0000000000D2F000-memory.dmpFilesize
16KB
-
memory/2064-138-0x0000000000D2B000-0x0000000000D2F000-memory.dmpFilesize
16KB
-
memory/2064-133-0x0000000000D2B000-0x0000000000D2F000-memory.dmpFilesize
16KB
-
memory/2064-140-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-158-0x0000000000D67000-0x0000000000D6A000-memory.dmpFilesize
12KB
-
memory/2064-141-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-143-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-144-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-145-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-146-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-148-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-149-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-150-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-151-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-152-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-132-0x0000000000D2B000-0x0000000000D2F000-memory.dmpFilesize
16KB
-
memory/2064-165-0x00000000029D0000-0x00000000029D8000-memory.dmpFilesize
32KB
-
memory/2064-137-0x0000000000D2B000-0x0000000000D2F000-memory.dmpFilesize
16KB
-
memory/2064-135-0x0000000000D2B000-0x0000000000D2F000-memory.dmpFilesize
16KB
-
memory/2064-139-0x0000000000D36000-0x0000000000D3B000-memory.dmpFilesize
20KB
-
memory/2064-156-0x0000000000D67000-0x0000000000D6A000-memory.dmpFilesize
12KB
-
memory/2064-161-0x0000000000D67000-0x0000000000D6A000-memory.dmpFilesize
12KB
-
memory/2064-163-0x0000000000D67000-0x0000000000D6A000-memory.dmpFilesize
12KB
-
memory/2064-159-0x0000000000D67000-0x0000000000D6A000-memory.dmpFilesize
12KB
-
memory/2064-160-0x0000000000D67000-0x0000000000D6A000-memory.dmpFilesize
12KB
-
memory/4516-172-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/4516-175-0x0000000002AA0000-0x0000000003AA0000-memory.dmpFilesize
16.0MB
-
memory/4516-174-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/4516-169-0x0000000000000000-mapping.dmp
-
memory/4516-173-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/4516-170-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/4516-171-0x0000000000400000-0x00000000005F7000-memory.dmpFilesize
2.0MB
-
memory/4632-166-0x00007FF9B6AE0000-0x00007FF9B75A1000-memory.dmpFilesize
10.8MB
-
memory/4632-162-0x000001BCF4A40000-0x000001BCF4EC2000-memory.dmpFilesize
4.5MB
-
memory/4632-154-0x0000000000000000-mapping.dmp
-
memory/4840-168-0x0000000074FA0000-0x0000000075551000-memory.dmpFilesize
5.7MB
-
memory/4840-167-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/4840-164-0x0000000000000000-mapping.dmp