Analysis

  • max time kernel
    188s
  • max time network
    179s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    26-06-2022 05:20

General

  • Target

    asdfg.exe

  • Size

    768KB

  • MD5

    63645a9e1f5e77ba3c75366f3a14ab87

  • SHA1

    ed1497c47dc283118bbc57d49cd9f354785cf73d

  • SHA256

    2ced9b36b931b73b1d325bececd01f0e4fa6bd0fff98f8b76f2f45b473311cd0

  • SHA512

    4efce16194322c1288603ccd4ab6507fa5905debb137ce9b200e7a76e2c041c2d2aa720061b0679f2dfb5c21a668e12fe5eeb5fe99542f5a88d4bcdf103296f0

Score
10/10

Malware Config

Extracted

Family

recordbreaker

C2

http://136.244.65.99/

http://140.82.52.55/

Signatures

  • RecordBreaker

    RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\asdfg.exe
    "C:\Users\Admin\AppData\Local\Temp\asdfg.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1984
    • C:\Users\Admin\AppData\Local\Temp\Fvmidruhvvwkpvmfzdjkqkyhgrn.exe
      "C:\Users\Admin\AppData\Local\Temp\Fvmidruhvvwkpvmfzdjkqkyhgrn.exe"
      2⤵
      • Executes dropped EXE
      PID:276
    • C:\Users\Admin\AppData\Local\Temp\asdfg.exe
      C:\Users\Admin\AppData\Local\Temp\asdfg.exe
      2⤵
        PID:964

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Fvmidruhvvwkpvmfzdjkqkyhgrn.exe
      Filesize

      21KB

      MD5

      f35a031075f711d05262e547d028ae86

      SHA1

      9c9e3bdf907fcfa959910cd9c752e297765ccf80

      SHA256

      3c0c5786499c54c8f99e689f7e1bfc129e4d10c3de58c7917fc73044e12346b9

      SHA512

      ff5235e388cc82f45e2dda4e93b66f752789b6cda1b6a4076af0171ab88ea422e8309a0f85abfa2d2e8ed5a760c3d83c4ec13fea9b566c0dd470a5c64c1a8a30

    • C:\Users\Admin\AppData\Local\Temp\Fvmidruhvvwkpvmfzdjkqkyhgrn.exe
      Filesize

      21KB

      MD5

      f35a031075f711d05262e547d028ae86

      SHA1

      9c9e3bdf907fcfa959910cd9c752e297765ccf80

      SHA256

      3c0c5786499c54c8f99e689f7e1bfc129e4d10c3de58c7917fc73044e12346b9

      SHA512

      ff5235e388cc82f45e2dda4e93b66f752789b6cda1b6a4076af0171ab88ea422e8309a0f85abfa2d2e8ed5a760c3d83c4ec13fea9b566c0dd470a5c64c1a8a30

    • \Users\Admin\AppData\Local\Temp\Fvmidruhvvwkpvmfzdjkqkyhgrn.exe
      Filesize

      21KB

      MD5

      f35a031075f711d05262e547d028ae86

      SHA1

      9c9e3bdf907fcfa959910cd9c752e297765ccf80

      SHA256

      3c0c5786499c54c8f99e689f7e1bfc129e4d10c3de58c7917fc73044e12346b9

      SHA512

      ff5235e388cc82f45e2dda4e93b66f752789b6cda1b6a4076af0171ab88ea422e8309a0f85abfa2d2e8ed5a760c3d83c4ec13fea9b566c0dd470a5c64c1a8a30

    • memory/276-65-0x0000000000030000-0x000000000003A000-memory.dmp
      Filesize

      40KB

    • memory/276-62-0x0000000000000000-mapping.dmp
    • memory/964-71-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

    • memory/964-72-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

    • memory/964-79-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

    • memory/964-74-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

    • memory/964-75-0x0000000000407486-mapping.dmp
    • memory/964-77-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

    • memory/964-69-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

    • memory/964-66-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

    • memory/964-67-0x0000000000400000-0x0000000000412000-memory.dmp
      Filesize

      72KB

    • memory/1756-54-0x0000000001030000-0x00000000010F6000-memory.dmp
      Filesize

      792KB

    • memory/1756-55-0x00000000049D0000-0x0000000004A92000-memory.dmp
      Filesize

      776KB

    • memory/1756-56-0x0000000000D00000-0x0000000000D4C000-memory.dmp
      Filesize

      304KB

    • memory/1984-60-0x000000006FF60000-0x000000007050B000-memory.dmp
      Filesize

      5.7MB

    • memory/1984-57-0x0000000000000000-mapping.dmp
    • memory/1984-58-0x0000000075951000-0x0000000075953000-memory.dmp
      Filesize

      8KB

    • memory/1984-59-0x000000006FF60000-0x000000007050B000-memory.dmp
      Filesize

      5.7MB