Analysis
- max time kernel
191s - max time network
190s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
01/10/2022, 21:31
General
- Target ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd.exe
- Size 3.1MB
- Sample221001-1c92sshfhn
- SHA256 ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd
Malware Config
Signatures
- r77
r77 is an open-source, userland rootkit.
- r77 rootkit payload 2 IoCs
Detects the payload of the r77 rootkit.
- Executes dropped EXE 1 IoCs
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd.exe"C:\Users\Admin\AppData\Local\Temp\ce8fa9dbe4da6788a1af959875494e429c9d328ce7aa288d2c1698593982bdbd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a.exeC:\Users\Admin\AppData\Local\Temp\\a.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
a.exe
a.exe
memory/2312-184-0x00007FFAD9BA0000-0x00007FFADA661000-memory.dmp
memory/2312-183-0x0000027F74F80000-0x0000027F74F8E000-memory.dmp
memory/2312-182-0x0000027F74FB0000-0x0000027F74FE8000-memory.dmp
memory/2312-181-0x0000027F76350000-0x0000027F76358000-memory.dmp
memory/2312-180-0x00007FFAD9BA0000-0x00007FFADA661000-memory.dmp
memory/2312-179-0x0000027F54930000-0x0000027F54962000-memory.dmp
memory/4960-144-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-174-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-150-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-154-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-156-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-162-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-164-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-168-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-170-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-172-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-166-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-152-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-160-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-158-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-175-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-148-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-132-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-146-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-138-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-142-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-140-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-136-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-134-0x0000000010000000-0x000000001003F000-memory.dmp
memory/4960-133-0x0000000010000000-0x000000001003F000-memory.dmp