5e6257951c22e3a84dc43ca8c4c1662ee6dbea213ddedf332a381d6324dd2bb5

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E-Posta Bildirimi pdf.exe
Size

1.8MB
MD5

844c618571ec3391014ae741256c55b4
SHA1

8f8bdc69c3f9b7e254a92acedf804bd28f1fba9d
SHA256

8a56ba9e9d571e7e4d1998b8f5771afccc88bbcdccfbe5f10fc8fe337f789215
SHA512

e830955dd198e02e452f4d68c67e20c5f616c6fe6e94790e8400844318ca507b08606109ce74564f4fa9797212ddbd4ef1c7d0d54480085d499b7343f28075b2

Score

9^/10

rezer0 upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dll	acprotect

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/948-57-0x00000000062C0000-0x0000000006426000-memory.dmp	rezer0

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dll	upx

Loads dropped DLL 1 IoCs

Processes:

E-Posta Bildirimi pdf.exe

pid process

1740 E-Posta Bildirimi pdf.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

E-Posta Bildirimi pdf.exe

description pid process target process

PID 948 set thread context of 1740 948 E-Posta Bildirimi pdf.exe E-Posta Bildirimi pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2000 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

E-Posta Bildirimi pdf.exe

pid process

948 E-Posta Bildirimi pdf.exe
948 E-Posta Bildirimi pdf.exe
948 E-Posta Bildirimi pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

E-Posta Bildirimi pdf.exeE-Posta Bildirimi pdf.exe

description pid process

Token: SeDebugPrivilege 948 E-Posta Bildirimi pdf.exe
Token: SeDebugPrivilege 1740 E-Posta Bildirimi pdf.exe

pid	process
1740	E-Posta Bildirimi pdf.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 948 set thread context of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe

pid	process
2000	schtasks.exe

pid	process
948	E-Posta Bildirimi pdf.exe
948	E-Posta Bildirimi pdf.exe
948	E-Posta Bildirimi pdf.exe

description	pid	process
Token: SeDebugPrivilege	948	E-Posta Bildirimi pdf.exe
Token: SeDebugPrivilege	1740	E-Posta Bildirimi pdf.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

E-Posta Bildirimi pdf.exe

description	pid	process	target process
PID 948 wrote to memory of 2000	948	E-Posta Bildirimi pdf.exe	schtasks.exe
PID 948 wrote to memory of 2000	948	E-Posta Bildirimi pdf.exe	schtasks.exe
PID 948 wrote to memory of 2000	948	E-Posta Bildirimi pdf.exe	schtasks.exe
PID 948 wrote to memory of 2000	948	E-Posta Bildirimi pdf.exe	schtasks.exe
PID 948 wrote to memory of 1880	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1880	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1880	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1880	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe
PID 948 wrote to memory of 1740	948	E-Posta Bildirimi pdf.exe	E-Posta Bildirimi pdf.exe

C:\Users\Admin\AppData\Local\Temp\E-Posta Bildirimi pdf.exe
"C:\Users\Admin\AppData\Local\Temp\E-Posta Bildirimi pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SxjjiZWECxmzG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB0AA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\E-Posta Bildirimi pdf.exe
  "{path}"
  2⤵
  PID:1880
- C:\Users\Admin\AppData\Local\Temp\E-Posta Bildirimi pdf.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB0AA.tmp

Filesize
1KB

MD5
bf9b466b943bd4d74a02abb2a89e7341

SHA1
eb0e85e76f6b89be242e2cd8ed815d06f8cebcb6

SHA256
d42632de92aaca98cf927a86155d601255db2b063b4992c0eb1ab3ef1e14c090

SHA512
76848f1ff4b5716190978e92ac49580ffdcaafbacb0fa18f909231367198cae813d3b3fe24a47e128ffb5e20de1739c052248bd267fcb689509536c7c3dc3c63

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dll

Filesize
594KB

MD5
e81aeac387c5db32b7f9b07d15e788e0

SHA1
829be6eaf1cb0d82b2ddfc98272e1087f4a7a7c3

SHA256
44f31f99f048bfc5195937353b5207332e455bcd5a722bcfd32cacfd93f60f06

SHA512
cc6a96325a01c50c059706a1f4156f109e502ef9c0b0f5de209d1f52e7cc973cebc027f57ed988e9d1b8fca62746b60ee7430d608de95cdd0e5ac3cb61fbe32e

Download Submit
memory/948-54-0x0000000001100000-0x00000000012DA000-memory.dmp

Filesize
1.9MB

Download
memory/948-55-0x0000000005CB0000-0x0000000005E44000-memory.dmp

Filesize
1.6MB

Download
memory/948-56-0x00000000004F0000-0x00000000004F8000-memory.dmp

Filesize
32KB

Download
memory/948-57-0x00000000062C0000-0x0000000006426000-memory.dmp

Filesize
1.4MB

Download
memory/1740-84-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-90-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-64-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-63-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-65-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-66-0x000000000055A26E-mapping.dmp

Download
memory/1740-70-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-68-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-72-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-74-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-76-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-78-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-80-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-82-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-60-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-88-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-86-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-61-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-92-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-94-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-96-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-98-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-100-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-104-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-102-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-108-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-106-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-112-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-110-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-116-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-114-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-120-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-118-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-124-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/1740-122-0x0000000000400000-0x0000000000560000-memory.dmp

Filesize
1.4MB

Download
memory/2000-58-0x0000000000000000-mapping.dmp

Download