fa5ac27700f443ba8bc0509f2ce8c1c0be408e3dbca55a07de27f7d1bcb5de16

Resubmissions

28-09-2022 15:55

220928-tcy6zaheeq 10

28-09-2022 15:52

220928-ta886agdd4 10

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DRBFSJC.exe
Size

3.7MB
MD5

fcdb10a4ed519ba71aa3c715e0785977
SHA1

39634afc86ffe83e71e1a5a387d1b4314f33d2fe
SHA256

fa5ac27700f443ba8bc0509f2ce8c1c0be408e3dbca55a07de27f7d1bcb5de16
SHA512

12b66c3f4f1b8d11b223d61cb3429d11a9eda83a4a28484dcf0e3ce4f0f55ebf5ede2433fb114e4f20ddf2c749e9f2e7028210cefc04e3eee030849ba516b153
SSDEEP

49152:LqgtfkiCBPMP2vdBUEyVJwjQ1pxDG2OTINXRA1ked1iutOdj:2N5MeBUbVOjKpxDROcN4keHVwd

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DRBFSJC.exe

pid process

1112 DRBFSJC.exe
1112 DRBFSJC.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DRBFSJC.exe

description pid process

Token: SeDebugPrivilege 1112 DRBFSJC.exe

pid	process
1112	DRBFSJC.exe
1112	DRBFSJC.exe

description	pid	process
Token: SeDebugPrivilege	1112	DRBFSJC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DRBFSJC.exe

description	pid	process	target process
PID 1112 wrote to memory of 2044	1112	DRBFSJC.exe	vbc.exe
PID 1112 wrote to memory of 2044	1112	DRBFSJC.exe	vbc.exe
PID 1112 wrote to memory of 2044	1112	DRBFSJC.exe	vbc.exe
PID 1112 wrote to memory of 2044	1112	DRBFSJC.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\DRBFSJC.exe
"C:\Users\Admin\AppData\Local\Temp\DRBFSJC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe"
2⤵
PID:2044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-54-0x0000000000070000-0x0000000000420000-memory.dmp

Filesize
3.7MB

Download
memory/1112-55-0x00000000006D0000-0x0000000000736000-memory.dmp

Filesize
408KB

Download