111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac

Analysis

max time kernel
169s
max time network
167s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe
Size

310KB
MD5

65fdbb3a71a31e567bd2463213e088e0
SHA1

c10c799b1388f09b991970a9ae8adfe33260b611
SHA256

111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac
SHA512

a093548330939aedcf12c2301932e7a606e8eb2e4f7306b855ecb28e7a12579dfb69cdf30376da530ea13360978feb56a91a7d5bf89980ffd03a49fde826b579
SSDEEP

6144:GUG/5j2IeB21yUFANQlD8Vn7hyogv+8GjOmvAQj/THLK:RhIgeydQl4Jtyom3GjlIQO

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
944	rieba.exe

Deletes itself 1 IoCs

pid	Process
1888	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe
900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	rieba.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rieba = "C:\\Users\\Admin\\AppData\\Roaming\\Xemeof\\rieba.exe"	rieba.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe
944	rieba.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 944	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	27
PID 900 wrote to memory of 944	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	27
PID 900 wrote to memory of 944	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	27
PID 900 wrote to memory of 944	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	27
PID 944 wrote to memory of 1140	944	rieba.exe	13
PID 944 wrote to memory of 1140	944	rieba.exe	13
PID 944 wrote to memory of 1140	944	rieba.exe	13
PID 944 wrote to memory of 1140	944	rieba.exe	13
PID 944 wrote to memory of 1140	944	rieba.exe	13
PID 944 wrote to memory of 1240	944	rieba.exe	12
PID 944 wrote to memory of 1240	944	rieba.exe	12
PID 944 wrote to memory of 1240	944	rieba.exe	12
PID 944 wrote to memory of 1240	944	rieba.exe	12
PID 944 wrote to memory of 1240	944	rieba.exe	12
PID 944 wrote to memory of 1296	944	rieba.exe	11
PID 944 wrote to memory of 1296	944	rieba.exe	11
PID 944 wrote to memory of 1296	944	rieba.exe	11
PID 944 wrote to memory of 1296	944	rieba.exe	11
PID 944 wrote to memory of 1296	944	rieba.exe	11
PID 944 wrote to memory of 900	944	rieba.exe	9
PID 944 wrote to memory of 900	944	rieba.exe	9
PID 944 wrote to memory of 900	944	rieba.exe	9
PID 944 wrote to memory of 900	944	rieba.exe	9
PID 944 wrote to memory of 900	944	rieba.exe	9
PID 900 wrote to memory of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28
PID 900 wrote to memory of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28
PID 900 wrote to memory of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28
PID 900 wrote to memory of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28
PID 900 wrote to memory of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28
PID 900 wrote to memory of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28
PID 900 wrote to memory of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28
PID 900 wrote to memory of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28
PID 900 wrote to memory of 1888	900	111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe	28

C:\Users\Admin\AppData\Local\Temp\111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe
"C:\Users\Admin\AppData\Local\Temp\111491f3d2c6b2d02588a285b3cbbe24cf96872a75691fba45ddc864454d9cac.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Roaming\Xemeof\rieba.exe
  "C:\Users\Admin\AppData\Roaming\Xemeof\rieba.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp90761a1b.bat"
  2⤵
  - Deletes itself
  PID:1888

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1296

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1240

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp90761a1b.bat

Filesize
307B

MD5
909cf657ef5b591918b648eb238949f9

SHA1
7f49cfd084b110270ee85db7090e470c92f6d12f

SHA256
09d000bbf81c6fe060a3b28ed4032e8a8c5b84eddcdc3bf062cad61301f8ddaf

SHA512
01236cd4e4c2f8f8082c30be8f925b9b18582ee558cd9ffe92f7ff5f9b6be701fc4c51b35ea4c5b6ea9ccc75829ee4155cd8d3204d9b611c229fa5873f06fea1

Download Submit
C:\Users\Admin\AppData\Roaming\Xemeof\rieba.exe

Filesize
310KB

MD5
c6a66ca6bad1cc137ee45f8e50faf07a

SHA1
bd8fceb08a88452172631f9b12e0483b3d6f0fee

SHA256
27bea219a37fdd53924575d2d4b57f674652452316e39c04411601354fe2d9dc

SHA512
c365fab3f11048011980e88ed776864dac7035341f4633250892ea105d392613909a01e3e3f8b56081e5e4426f46291d743816dca0209c44cafde0141845f158

Download Submit
C:\Users\Admin\AppData\Roaming\Xemeof\rieba.exe

Filesize
310KB

MD5
c6a66ca6bad1cc137ee45f8e50faf07a

SHA1
bd8fceb08a88452172631f9b12e0483b3d6f0fee

SHA256
27bea219a37fdd53924575d2d4b57f674652452316e39c04411601354fe2d9dc

SHA512
c365fab3f11048011980e88ed776864dac7035341f4633250892ea105d392613909a01e3e3f8b56081e5e4426f46291d743816dca0209c44cafde0141845f158

Download Submit
\Users\Admin\AppData\Roaming\Xemeof\rieba.exe

Filesize
310KB

MD5
c6a66ca6bad1cc137ee45f8e50faf07a

SHA1
bd8fceb08a88452172631f9b12e0483b3d6f0fee

SHA256
27bea219a37fdd53924575d2d4b57f674652452316e39c04411601354fe2d9dc

SHA512
c365fab3f11048011980e88ed776864dac7035341f4633250892ea105d392613909a01e3e3f8b56081e5e4426f46291d743816dca0209c44cafde0141845f158

Download Submit
\Users\Admin\AppData\Roaming\Xemeof\rieba.exe

Filesize
310KB

MD5
c6a66ca6bad1cc137ee45f8e50faf07a

SHA1
bd8fceb08a88452172631f9b12e0483b3d6f0fee

SHA256
27bea219a37fdd53924575d2d4b57f674652452316e39c04411601354fe2d9dc

SHA512
c365fab3f11048011980e88ed776864dac7035341f4633250892ea105d392613909a01e3e3f8b56081e5e4426f46291d743816dca0209c44cafde0141845f158

Download Submit
memory/900-103-0x0000000001F00000-0x0000000001F48000-memory.dmp

Filesize
288KB

Download
memory/900-94-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/900-56-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/900-86-0x0000000001F00000-0x0000000001F48000-memory.dmp

Filesize
288KB

Download
memory/900-54-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/900-85-0x0000000001F00000-0x0000000001F48000-memory.dmp

Filesize
288KB

Download
memory/900-55-0x0000000000401000-0x0000000000441000-memory.dmp

Filesize
256KB

Download
memory/900-87-0x0000000001F00000-0x0000000001F48000-memory.dmp

Filesize
288KB

Download
memory/900-93-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/900-92-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/900-91-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/900-89-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/900-90-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/900-88-0x0000000001F00000-0x0000000001F48000-memory.dmp

Filesize
288KB

Download
memory/944-62-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1140-70-0x0000000000410000-0x0000000000458000-memory.dmp

Filesize
288KB

Download
memory/1140-68-0x0000000000410000-0x0000000000458000-memory.dmp

Filesize
288KB

Download
memory/1140-69-0x0000000000410000-0x0000000000458000-memory.dmp

Filesize
288KB

Download
memory/1140-65-0x0000000000410000-0x0000000000458000-memory.dmp

Filesize
288KB

Download
memory/1140-67-0x0000000000410000-0x0000000000458000-memory.dmp

Filesize
288KB

Download
memory/1240-74-0x0000000001CE0000-0x0000000001D28000-memory.dmp

Filesize
288KB

Download
memory/1240-76-0x0000000001CE0000-0x0000000001D28000-memory.dmp

Filesize
288KB

Download
memory/1240-75-0x0000000001CE0000-0x0000000001D28000-memory.dmp

Filesize
288KB

Download
memory/1240-73-0x0000000001CE0000-0x0000000001D28000-memory.dmp

Filesize
288KB

Download
memory/1296-82-0x00000000029D0000-0x0000000002A18000-memory.dmp

Filesize
288KB

Download
memory/1296-81-0x00000000029D0000-0x0000000002A18000-memory.dmp

Filesize
288KB

Download
memory/1296-80-0x00000000029D0000-0x0000000002A18000-memory.dmp

Filesize
288KB

Download
memory/1296-79-0x00000000029D0000-0x0000000002A18000-memory.dmp

Filesize
288KB

Download
memory/1888-99-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download
memory/1888-101-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download
memory/1888-100-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download
memory/1888-105-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1888-106-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1888-107-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1888-108-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1888-109-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1888-110-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1888-111-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1888-97-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download
memory/1888-113-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download