Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-10-2022 12:35
Behavioral task
behavioral1
Sample
146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe
Resource
win7-20220812-en
General
-
Target
146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe
-
Size
967KB
-
MD5
b03ccade490854df220914c4430967e2
-
SHA1
1911a59e8c4b427d3fbc8fc9c794886bd2d81305
-
SHA256
81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961
-
SHA512
0c05ff99f2d2f448c431073b9a339e6dc1ccab43c9442be44edfd493c3d4d9bd604a0deb792b91295571817113c309bafc6d230b470a4874493561bd5aa9bc36
-
SSDEEP
24576:xNxsglIPAtgV+rnEQBg2AdqgwGd9OCPltP0gxkR3dCqJO5VxQ75Sf1:57uKrnEQi2Ad/wQPLP0gx1qt5Sf1
Malware Config
Signatures
-
PlagueBot Executable 5 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\discordnitro\winmgr.exe plaguebot \Users\Admin\AppData\Roaming\discordnitro\winmgr.exe plaguebot C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe plaguebot C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe plaguebot C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe plaguebot -
Executes dropped EXE 2 IoCs
Processes:
winmgr.exewinmgr.exepid process 1244 winmgr.exe 1688 winmgr.exe -
Loads dropped DLL 2 IoCs
Processes:
146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exepid process 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 572 timeout.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exetaskeng.exewinmgr.execmd.exedescription pid process target process PID 360 wrote to memory of 288 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe schtasks.exe PID 360 wrote to memory of 288 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe schtasks.exe PID 360 wrote to memory of 288 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe schtasks.exe PID 360 wrote to memory of 288 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe schtasks.exe PID 360 wrote to memory of 956 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe schtasks.exe PID 360 wrote to memory of 956 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe schtasks.exe PID 360 wrote to memory of 956 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe schtasks.exe PID 360 wrote to memory of 956 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe schtasks.exe PID 360 wrote to memory of 1244 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe winmgr.exe PID 360 wrote to memory of 1244 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe winmgr.exe PID 360 wrote to memory of 1244 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe winmgr.exe PID 360 wrote to memory of 1244 360 146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe winmgr.exe PID 324 wrote to memory of 1688 324 taskeng.exe winmgr.exe PID 324 wrote to memory of 1688 324 taskeng.exe winmgr.exe PID 324 wrote to memory of 1688 324 taskeng.exe winmgr.exe PID 324 wrote to memory of 1688 324 taskeng.exe winmgr.exe PID 1244 wrote to memory of 608 1244 winmgr.exe schtasks.exe PID 1244 wrote to memory of 608 1244 winmgr.exe schtasks.exe PID 1244 wrote to memory of 608 1244 winmgr.exe schtasks.exe PID 1244 wrote to memory of 608 1244 winmgr.exe schtasks.exe PID 1244 wrote to memory of 556 1244 winmgr.exe cmd.exe PID 1244 wrote to memory of 556 1244 winmgr.exe cmd.exe PID 1244 wrote to memory of 556 1244 winmgr.exe cmd.exe PID 1244 wrote to memory of 556 1244 winmgr.exe cmd.exe PID 556 wrote to memory of 572 556 cmd.exe timeout.exe PID 556 wrote to memory of 572 556 cmd.exe timeout.exe PID 556 wrote to memory of 572 556 cmd.exe timeout.exe PID 556 wrote to memory of 572 556 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe"C:\Users\Admin\AppData\Local\Temp\146.70.143.176_-_MAL_-_Server.exe___b03ccade490854df220914c4430967e2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Query /FO "LIST" /TN "WinManager"2⤵
-
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe"C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe" /wait2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN "WinManager"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C timeout 5 & del /F /Q "C:\Users\Admin\AppData\Roaming\discordnitro\*.*" & rmdir "C:\Users\Admin\AppData\Roaming\discordnitro"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 54⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\taskeng.exetaskeng.exe {793D357F-EAC1-4A68-B8E6-A153F6A8200D} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exeC:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\NewTask.xmlFilesize
1KB
MD5a34897a7e0a00c1dcbeac116606af248
SHA13a941c98a33853976d8b6697e8a33cc9bed56e78
SHA256cd527546a9c50c9081cc30dee45db0a496242363cd4212bce5930e4318327f29
SHA512364ce0e2525f915c4ca4fe9cacf6dcd3160da814370db54bfd9756cc750b6295f19d72d0f15f658bc0b211b1bce5e4b2664d13990cea1ad51535d4bc9366310a
-
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exeFilesize
967KB
MD5b63bb68654e7be72058398809d6c4754
SHA14a7b43488029a2d4c960c9ee4431b99c8640a4b0
SHA2568db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe
SHA512c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a
-
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exeFilesize
967KB
MD5b63bb68654e7be72058398809d6c4754
SHA14a7b43488029a2d4c960c9ee4431b99c8640a4b0
SHA2568db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe
SHA512c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a
-
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exeFilesize
967KB
MD5b63bb68654e7be72058398809d6c4754
SHA14a7b43488029a2d4c960c9ee4431b99c8640a4b0
SHA2568db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe
SHA512c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a
-
\Users\Admin\AppData\Roaming\discordnitro\winmgr.exeFilesize
967KB
MD5b63bb68654e7be72058398809d6c4754
SHA14a7b43488029a2d4c960c9ee4431b99c8640a4b0
SHA2568db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe
SHA512c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a
-
\Users\Admin\AppData\Roaming\discordnitro\winmgr.exeFilesize
967KB
MD5b63bb68654e7be72058398809d6c4754
SHA14a7b43488029a2d4c960c9ee4431b99c8640a4b0
SHA2568db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe
SHA512c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a
-
memory/288-55-0x0000000000000000-mapping.dmp
-
memory/360-54-0x0000000075771000-0x0000000075773000-memory.dmpFilesize
8KB
-
memory/556-68-0x0000000000000000-mapping.dmp
-
memory/572-69-0x0000000000000000-mapping.dmp
-
memory/608-67-0x0000000000000000-mapping.dmp
-
memory/956-57-0x0000000000000000-mapping.dmp
-
memory/1244-60-0x0000000000000000-mapping.dmp
-
memory/1688-64-0x0000000000000000-mapping.dmp