9fd392cb0625064392be62c5ac1fd196236bccc2ee8be8fbc0334ac1f2edbe87

General

Target

yeni sifari?.exe
Size

852KB
MD5

9367062ce634b7d681f9c2c9be8ca36b
SHA1

432245fb29ac4467fe4a6351f389cf336ec344e1
SHA256

326d9a3cd91e4bc994ff17720650d3eb08d4c502ed4847f5fe8496b7ba50a6b9
SHA512

f18688b1387c02b7d517836b4c421a60dfa754a710ced665437d2945b6b651fe80281634075193e2bfa3e562670db9c0024127af0bf1b7c4b61571621b03aa1f

Score

10^/10

coreentity rezer0

Malware Config

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1676-56-0x0000000000960000-0x0000000000968000-memory.dmp	coreentity

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1676-57-0x0000000008540000-0x00000000085EE000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

yeni sifari_.exe

description pid process target process

PID 1676 set thread context of 2028 1676 yeni sifari_.exe yeni sifari_.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1772 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

yeni sifari_.exe

pid process

1676 yeni sifari_.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

yeni sifari_.exeyeni sifari_.exe

description pid process

Token: SeDebugPrivilege 1676 yeni sifari_.exe
Token: SeDebugPrivilege 2028 yeni sifari_.exe

description	pid	process	target process
PID 1676 set thread context of 2028	1676	yeni sifari_.exe	yeni sifari_.exe

pid	process
1772	schtasks.exe

pid	process
1676	yeni sifari_.exe

description	pid	process
Token: SeDebugPrivilege	1676	yeni sifari_.exe
Token: SeDebugPrivilege	2028	yeni sifari_.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

yeni sifari_.exe

description	pid	process	target process
PID 1676 wrote to memory of 1772	1676	yeni sifari_.exe	schtasks.exe
PID 1676 wrote to memory of 1772	1676	yeni sifari_.exe	schtasks.exe
PID 1676 wrote to memory of 1772	1676	yeni sifari_.exe	schtasks.exe
PID 1676 wrote to memory of 1772	1676	yeni sifari_.exe	schtasks.exe
PID 1676 wrote to memory of 2028	1676	yeni sifari_.exe	yeni sifari_.exe
PID 1676 wrote to memory of 2028	1676	yeni sifari_.exe	yeni sifari_.exe
PID 1676 wrote to memory of 2028	1676	yeni sifari_.exe	yeni sifari_.exe
PID 1676 wrote to memory of 2028	1676	yeni sifari_.exe	yeni sifari_.exe
PID 1676 wrote to memory of 2028	1676	yeni sifari_.exe	yeni sifari_.exe
PID 1676 wrote to memory of 2028	1676	yeni sifari_.exe	yeni sifari_.exe
PID 1676 wrote to memory of 2028	1676	yeni sifari_.exe	yeni sifari_.exe
PID 1676 wrote to memory of 2028	1676	yeni sifari_.exe	yeni sifari_.exe
PID 1676 wrote to memory of 2028	1676	yeni sifari_.exe	yeni sifari_.exe

C:\Users\Admin\AppData\Local\Temp\yeni sifari_.exe
"C:\Users\Admin\AppData\Local\Temp\yeni sifari_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xTigNOYXGDgBjs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF355.tmp"
2⤵
- Creates scheduled task(s)
PID:1772

C:\Users\Admin\AppData\Local\Temp\yeni sifari_.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF355.tmp
Filesize
1KB

MD5
96a1dc796a647c958cc60457ecfd1212

SHA1
2930f49e2cc97dff9bd3feef4d49cebbfb85cf2e

SHA256
2e6a2182e22de980b9a6c510e235d2c4cacb3f46a8401fc3dd6c77db823181a2

SHA512
a5d8d22f668ffb1201a2ec8947a0cd1de01e04cfc925fdd6af735c8711b2283b5c3638265f16febe358936a666a07ce946d23fd3de5e3407582628ccec503437

Download Submit
memory/1676-54-0x00000000012A0000-0x000000000137C000-memory.dmp

Filesize
880KB

Download
memory/1676-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1676-56-0x0000000000960000-0x0000000000968000-memory.dmp

Filesize
32KB

Download
memory/1676-57-0x0000000008540000-0x00000000085EE000-memory.dmp

Filesize
696KB

Download
memory/1676-60-0x00000000086B0000-0x0000000008756000-memory.dmp

Filesize
664KB

Download
memory/1772-58-0x0000000000000000-mapping.dmp

Download
memory/2028-83-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-91-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-64-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-65-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-66-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-67-0x00000000004A155E-mapping.dmp

Download
memory/2028-69-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-71-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-73-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-75-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-77-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-79-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-81-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-61-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-85-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-87-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-89-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-62-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-93-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-95-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-97-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-99-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-101-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-103-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-105-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-107-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-109-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-111-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-113-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-115-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-117-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-119-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-121-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2028-123-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads