Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-06-2022 06:21
Static task
static1
Behavioral task
behavioral1
Sample
zxcvb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
zxcvb.exe
Resource
win10v2004-20220414-en
General
-
Target
zxcvb.exe
-
Size
768KB
-
MD5
63645a9e1f5e77ba3c75366f3a14ab87
-
SHA1
ed1497c47dc283118bbc57d49cd9f354785cf73d
-
SHA256
2ced9b36b931b73b1d325bececd01f0e4fa6bd0fff98f8b76f2f45b473311cd0
-
SHA512
4efce16194322c1288603ccd4ab6507fa5905debb137ce9b200e7a76e2c041c2d2aa720061b0679f2dfb5c21a668e12fe5eeb5fe99542f5a88d4bcdf103296f0
Malware Config
Extracted
recordbreaker
http://136.244.65.99/
http://140.82.52.55/
Signatures
-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
Executes dropped EXE 1 IoCs
Processes:
Fvmidruhvvwkpvmfzdjkqkyhgrn.exepid process 4600 Fvmidruhvvwkpvmfzdjkqkyhgrn.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
zxcvb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation zxcvb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zxcvb.exedescription pid process target process PID 3124 set thread context of 3780 3124 zxcvb.exe zxcvb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exezxcvb.exepid process 4236 powershell.exe 4236 powershell.exe 3124 zxcvb.exe 3124 zxcvb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
zxcvb.exepowershell.exedescription pid process Token: SeDebugPrivilege 3124 zxcvb.exe Token: SeDebugPrivilege 4236 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
zxcvb.exedescription pid process target process PID 3124 wrote to memory of 4236 3124 zxcvb.exe powershell.exe PID 3124 wrote to memory of 4236 3124 zxcvb.exe powershell.exe PID 3124 wrote to memory of 4236 3124 zxcvb.exe powershell.exe PID 3124 wrote to memory of 4600 3124 zxcvb.exe Fvmidruhvvwkpvmfzdjkqkyhgrn.exe PID 3124 wrote to memory of 4600 3124 zxcvb.exe Fvmidruhvvwkpvmfzdjkqkyhgrn.exe PID 3124 wrote to memory of 4600 3124 zxcvb.exe Fvmidruhvvwkpvmfzdjkqkyhgrn.exe PID 3124 wrote to memory of 3780 3124 zxcvb.exe zxcvb.exe PID 3124 wrote to memory of 3780 3124 zxcvb.exe zxcvb.exe PID 3124 wrote to memory of 3780 3124 zxcvb.exe zxcvb.exe PID 3124 wrote to memory of 3780 3124 zxcvb.exe zxcvb.exe PID 3124 wrote to memory of 3780 3124 zxcvb.exe zxcvb.exe PID 3124 wrote to memory of 3780 3124 zxcvb.exe zxcvb.exe PID 3124 wrote to memory of 3780 3124 zxcvb.exe zxcvb.exe PID 3124 wrote to memory of 3780 3124 zxcvb.exe zxcvb.exe PID 3124 wrote to memory of 3780 3124 zxcvb.exe zxcvb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Fvmidruhvvwkpvmfzdjkqkyhgrn.exe"C:\Users\Admin\AppData\Local\Temp\Fvmidruhvvwkpvmfzdjkqkyhgrn.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\zxcvb.exeC:\Users\Admin\AppData\Local\Temp\zxcvb.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Fvmidruhvvwkpvmfzdjkqkyhgrn.exeFilesize
21KB
MD5f35a031075f711d05262e547d028ae86
SHA19c9e3bdf907fcfa959910cd9c752e297765ccf80
SHA2563c0c5786499c54c8f99e689f7e1bfc129e4d10c3de58c7917fc73044e12346b9
SHA512ff5235e388cc82f45e2dda4e93b66f752789b6cda1b6a4076af0171ab88ea422e8309a0f85abfa2d2e8ed5a760c3d83c4ec13fea9b566c0dd470a5c64c1a8a30
-
C:\Users\Admin\AppData\Local\Temp\Fvmidruhvvwkpvmfzdjkqkyhgrn.exeFilesize
21KB
MD5f35a031075f711d05262e547d028ae86
SHA19c9e3bdf907fcfa959910cd9c752e297765ccf80
SHA2563c0c5786499c54c8f99e689f7e1bfc129e4d10c3de58c7917fc73044e12346b9
SHA512ff5235e388cc82f45e2dda4e93b66f752789b6cda1b6a4076af0171ab88ea422e8309a0f85abfa2d2e8ed5a760c3d83c4ec13fea9b566c0dd470a5c64c1a8a30
-
memory/3124-130-0x0000000000B60000-0x0000000000C26000-memory.dmpFilesize
792KB
-
memory/3124-131-0x0000000005480000-0x00000000054F6000-memory.dmpFilesize
472KB
-
memory/3124-132-0x0000000005850000-0x00000000058A0000-memory.dmpFilesize
320KB
-
memory/3124-133-0x00000000058A0000-0x0000000005952000-memory.dmpFilesize
712KB
-
memory/3124-134-0x0000000001350000-0x000000000136E000-memory.dmpFilesize
120KB
-
memory/3124-135-0x0000000005C20000-0x0000000005CB2000-memory.dmpFilesize
584KB
-
memory/3780-161-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3780-160-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3780-158-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3780-157-0x0000000000000000-mapping.dmp
-
memory/4236-144-0x0000000006090000-0x00000000060AA000-memory.dmpFilesize
104KB
-
memory/4236-151-0x0000000007200000-0x000000000721A000-memory.dmpFilesize
104KB
-
memory/4236-142-0x0000000005B20000-0x0000000005B3E000-memory.dmpFilesize
120KB
-
memory/4236-145-0x0000000006E10000-0x0000000006E42000-memory.dmpFilesize
200KB
-
memory/4236-146-0x000000006FFE0000-0x000000007002C000-memory.dmpFilesize
304KB
-
memory/4236-147-0x0000000004870000-0x000000000488E000-memory.dmpFilesize
120KB
-
memory/4236-148-0x0000000006260000-0x000000000626A000-memory.dmpFilesize
40KB
-
memory/4236-149-0x0000000007140000-0x00000000071D6000-memory.dmpFilesize
600KB
-
memory/4236-150-0x00000000070F0000-0x00000000070FE000-memory.dmpFilesize
56KB
-
memory/4236-143-0x0000000007490000-0x0000000007B0A000-memory.dmpFilesize
6.5MB
-
memory/4236-152-0x00000000071E0000-0x00000000071E8000-memory.dmpFilesize
32KB
-
memory/4236-136-0x0000000000000000-mapping.dmp
-
memory/4236-141-0x0000000005670000-0x00000000056D6000-memory.dmpFilesize
408KB
-
memory/4236-140-0x0000000005580000-0x00000000055E6000-memory.dmpFilesize
408KB
-
memory/4236-137-0x0000000000DD0000-0x0000000000E06000-memory.dmpFilesize
216KB
-
memory/4236-139-0x0000000005390000-0x00000000053B2000-memory.dmpFilesize
136KB
-
memory/4236-138-0x0000000004C70000-0x0000000005298000-memory.dmpFilesize
6.2MB
-
memory/4600-156-0x0000000000BE0000-0x0000000000BEA000-memory.dmpFilesize
40KB
-
memory/4600-153-0x0000000000000000-mapping.dmp