Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-07-2022 13:50
Static task
static1
Behavioral task
behavioral1
Sample
b58ce9efc60bf3b96e5ae33f0ff0d5db.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b58ce9efc60bf3b96e5ae33f0ff0d5db.exe
Resource
win10v2004-20220414-en
General
-
Target
b58ce9efc60bf3b96e5ae33f0ff0d5db.exe
-
Size
1.7MB
-
MD5
b58ce9efc60bf3b96e5ae33f0ff0d5db
-
SHA1
b6d43d0e1979328a6e9f70e7606ee29e3011ccf1
-
SHA256
a2a7bcdb4d33cd563018a1b9875a49a89d6637b8b0843de2b8f62bc65f980071
-
SHA512
6d26907ac1cc5d95197f381c1b276a6d653e7d8274a5e11c7df927303228960a2f20525be7fcf0902bc538ae230f6a21ae3592ba4386296a6571f26fd1b11599
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4112-133-0x0000000000400000-0x00000000007A3000-memory.dmp upx behavioral2/memory/4112-134-0x0000000000400000-0x00000000007A3000-memory.dmp upx behavioral2/memory/4112-135-0x0000000000400000-0x00000000007A3000-memory.dmp upx behavioral2/memory/4112-136-0x0000000000400000-0x00000000007A3000-memory.dmp upx behavioral2/memory/4112-137-0x0000000000400000-0x00000000007A3000-memory.dmp upx behavioral2/memory/4112-138-0x0000000000400000-0x00000000007A3000-memory.dmp upx behavioral2/memory/4112-139-0x0000000000400000-0x00000000007A3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b58ce9efc60bf3b96e5ae33f0ff0d5db.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" b58ce9efc60bf3b96e5ae33f0ff0d5db.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ b58ce9efc60bf3b96e5ae33f0ff0d5db.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b58ce9efc60bf3b96e5ae33f0ff0d5db.exedescription pid process target process PID 1264 set thread context of 4112 1264 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe b58ce9efc60bf3b96e5ae33f0ff0d5db.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
b58ce9efc60bf3b96e5ae33f0ff0d5db.exepid process 4112 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe 4112 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe 4112 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe 4112 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe 4112 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe 4112 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b58ce9efc60bf3b96e5ae33f0ff0d5db.exedescription pid process target process PID 1264 wrote to memory of 4112 1264 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe b58ce9efc60bf3b96e5ae33f0ff0d5db.exe PID 1264 wrote to memory of 4112 1264 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe b58ce9efc60bf3b96e5ae33f0ff0d5db.exe PID 1264 wrote to memory of 4112 1264 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe b58ce9efc60bf3b96e5ae33f0ff0d5db.exe PID 1264 wrote to memory of 4112 1264 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe b58ce9efc60bf3b96e5ae33f0ff0d5db.exe PID 1264 wrote to memory of 4112 1264 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe b58ce9efc60bf3b96e5ae33f0ff0d5db.exe PID 1264 wrote to memory of 4112 1264 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe b58ce9efc60bf3b96e5ae33f0ff0d5db.exe PID 1264 wrote to memory of 4112 1264 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe b58ce9efc60bf3b96e5ae33f0ff0d5db.exe PID 1264 wrote to memory of 4112 1264 b58ce9efc60bf3b96e5ae33f0ff0d5db.exe b58ce9efc60bf3b96e5ae33f0ff0d5db.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58ce9efc60bf3b96e5ae33f0ff0d5db.exe"C:\Users\Admin\AppData\Local\Temp\b58ce9efc60bf3b96e5ae33f0ff0d5db.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b58ce9efc60bf3b96e5ae33f0ff0d5db.exe"C:\Users\Admin\AppData\Local\Temp\b58ce9efc60bf3b96e5ae33f0ff0d5db.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1264-130-0x0000000000E58000-0x0000000000FDB000-memory.dmpFilesize
1.5MB
-
memory/1264-131-0x0000000002AC0000-0x0000000002C43000-memory.dmpFilesize
1.5MB
-
memory/4112-132-0x0000000000000000-mapping.dmp
-
memory/4112-133-0x0000000000400000-0x00000000007A3000-memory.dmpFilesize
3.6MB
-
memory/4112-134-0x0000000000400000-0x00000000007A3000-memory.dmpFilesize
3.6MB
-
memory/4112-135-0x0000000000400000-0x00000000007A3000-memory.dmpFilesize
3.6MB
-
memory/4112-136-0x0000000000400000-0x00000000007A3000-memory.dmpFilesize
3.6MB
-
memory/4112-137-0x0000000000400000-0x00000000007A3000-memory.dmpFilesize
3.6MB
-
memory/4112-138-0x0000000000400000-0x00000000007A3000-memory.dmpFilesize
3.6MB
-
memory/4112-139-0x0000000000400000-0x00000000007A3000-memory.dmpFilesize
3.6MB