Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 01:33
Static task
static1
Behavioral task
behavioral1
Sample
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe
Resource
win7-20220414-en
General
-
Target
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe
-
Size
406KB
-
MD5
7a53429710e5d456bd79c147316c1bbb
-
SHA1
4d46fc427c0c5aa412e13b96dd6be72044ceb18d
-
SHA256
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135
-
SHA512
2673325f08ff43f0a6afcdac341f7fe944927153c09efb14e16dd53974cabba283ca41c03a5c40bc5e0d5d5537d7757284ef7dce70383881deb6c0d2efaa769a
Malware Config
Signatures
-
KPOT Core Executable 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1832-62-0x0000000000400000-0x000000000041B000-memory.dmp family_kpot behavioral1/memory/1832-63-0x0000000000400000-0x000000000041B000-memory.dmp family_kpot behavioral1/memory/1832-64-0x0000000000400000-0x000000000041B000-memory.dmp family_kpot behavioral1/memory/1832-65-0x0000000000412B56-mapping.dmp family_kpot behavioral1/memory/1832-68-0x0000000000400000-0x000000000041B000-memory.dmp family_kpot -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1996-58-0x0000000000600000-0x0000000000626000-memory.dmp rezer0 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1204 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exedescription pid process target process PID 1996 set thread context of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exepid process 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exedescription pid process Token: SeDebugPrivilege 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.execmd.exedescription pid process target process PID 1996 wrote to memory of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 1996 wrote to memory of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 1996 wrote to memory of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 1996 wrote to memory of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 1996 wrote to memory of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 1996 wrote to memory of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 1996 wrote to memory of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 1996 wrote to memory of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 1996 wrote to memory of 1832 1996 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe PID 1832 wrote to memory of 1204 1832 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe cmd.exe PID 1832 wrote to memory of 1204 1832 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe cmd.exe PID 1832 wrote to memory of 1204 1832 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe cmd.exe PID 1832 wrote to memory of 1204 1832 53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe cmd.exe PID 1204 wrote to memory of 328 1204 cmd.exe PING.EXE PID 1204 wrote to memory of 328 1204 cmd.exe PING.EXE PID 1204 wrote to memory of 328 1204 cmd.exe PING.EXE PID 1204 wrote to memory of 328 1204 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe"C:\Users\Admin\AppData\Local\Temp\53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/328-69-0x0000000000000000-mapping.dmp
-
memory/1204-67-0x0000000000000000-mapping.dmp
-
memory/1832-64-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1832-59-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1832-60-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1832-62-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1832-63-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1832-65-0x0000000000412B56-mapping.dmp
-
memory/1832-68-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1996-57-0x0000000000260000-0x000000000026E000-memory.dmpFilesize
56KB
-
memory/1996-58-0x0000000000600000-0x0000000000626000-memory.dmpFilesize
152KB
-
memory/1996-54-0x0000000000DF0000-0x0000000000E5C000-memory.dmpFilesize
432KB
-
memory/1996-56-0x00000000005D0000-0x0000000000600000-memory.dmpFilesize
192KB
-
memory/1996-55-0x0000000075381000-0x0000000075383000-memory.dmpFilesize
8KB