Overview

overview

10

Static

static

Client Bal...20.exe

windows7_x64

9

Client Bal...20.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    42s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 23:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client Balance Payment For May 2020.exe

  • Size

    634KB

  • MD5

    c6603658b741087d4102daf507299972

  • SHA1

    333926e746e769624dcb1d2bf8fde751aa9c00fa

  • SHA256

    e7d122486a566fba3c38b1b542c77d33550c62e82e51d1cfac21d08c9eac4a33

  • SHA512

    783863a858d8fb665aa2a72f03ddb28fec2e1394e0fea11cf1f3ae33c19399a689562c0541900b7c6742b8e5911dcc41f7f7752c8cf961f43d9d86a9e990ed4a

Score
9/10
rezer0

Malware Config

Signatures

  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client Balance Payment For May 2020.exe
    "C:\Users\Admin\AppData\Local\Temp\Client Balance Payment For May 2020.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OyOQFrhs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp88C0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2044
    • C:\Users\Admin\AppData\Local\Temp\Client Balance Payment For May 2020.exe
      "{path}"
      2⤵
        PID:1072
      • C:\Users\Admin\AppData\Local\Temp\Client Balance Payment For May 2020.exe
        "{path}"
        2⤵
          PID:2008
        • C:\Users\Admin\AppData\Local\Temp\Client Balance Payment For May 2020.exe
          "{path}"
          2⤵
            PID:1972
          • C:\Users\Admin\AppData\Local\Temp\Client Balance Payment For May 2020.exe
            "{path}"
            2⤵
              PID:1616
            • C:\Users\Admin\AppData\Local\Temp\Client Balance Payment For May 2020.exe
              "{path}"
              2⤵
                PID:276

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Defense Evasion

            Credential Access

            Discovery

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp88C0.tmp
              Filesize

              1KB

              MD5

              0a7acbd33a7e8e482d61607a5c30fd43

              SHA1

              337baed05a8ec5bcfac29409bc26dea7205631ab

              SHA256

              f6beb2c818a571edb26096ba3bb1c63e4bb946d231c159ddbc5a8a5c81b8da83

              SHA512

              fcf5c8a04f472fcb277bf405942461ce93c97c03316682497bc708287ffb935248a79baaa2c5b414cdfdff3b888db752f78219ad71697b0c3e95d79221d879a6

              Download Submit
            • memory/1564-54-0x00000000003B0000-0x0000000000454000-memory.dmp
              Filesize

              656KB

              Download
            • memory/1564-55-0x0000000000240000-0x0000000000252000-memory.dmp
              Filesize

              72KB

              Download
            • memory/1564-56-0x0000000001FC0000-0x0000000002018000-memory.dmp
              Filesize

              352KB

              Download
            • memory/2044-57-0x0000000000000000-mapping.dmp
              Download