Analysis
-
max time kernel
67s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:33
Static task
static1
Behavioral task
behavioral1
Sample
845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe
Resource
win10v2004-20220901-en
General
-
Target
845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe
-
Size
609KB
-
MD5
a79bcc830c8a002cd5f71abf9edbff95
-
SHA1
4c4846f81fd2b5758c81e7715d46d053cd5fa512
-
SHA256
845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab
-
SHA512
c233a41bee6ced3995380e13c4d7f39436465a479924644c5cf2c7e7a5f31d9c8928388d380844d507666237bb4fc387bffe4415b24f5a457ad06ffff46f214b
-
SSDEEP
12288:uwu0R1wMbuUgn9iB4bva3ImroWiMUIzx:PwMhg8ub0ImcWNUG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
malremtool.exepid process 900 malremtool.exe -
Loads dropped DLL 4 IoCs
Processes:
845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exepid process 1932 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe 1932 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe 1932 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe 1932 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
malremtool.exedescription ioc process File opened for modification \??\PhysicalDrive0 malremtool.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
malremtool.exepid process 900 malremtool.exe 900 malremtool.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exepid process 1932 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exedescription pid process target process PID 1932 wrote to memory of 900 1932 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe malremtool.exe PID 1932 wrote to memory of 900 1932 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe malremtool.exe PID 1932 wrote to memory of 900 1932 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe malremtool.exe PID 1932 wrote to memory of 900 1932 845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe malremtool.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe"C:\Users\Admin\AppData\Local\Temp\845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\malremtool.exe"C:\Users\Admin\AppData\Local\Temp\malremtool.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:900
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1668
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1532
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\malremtool.exeFilesize
609KB
MD5a79bcc830c8a002cd5f71abf9edbff95
SHA14c4846f81fd2b5758c81e7715d46d053cd5fa512
SHA256845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab
SHA512c233a41bee6ced3995380e13c4d7f39436465a479924644c5cf2c7e7a5f31d9c8928388d380844d507666237bb4fc387bffe4415b24f5a457ad06ffff46f214b
-
\Users\Admin\AppData\Local\Temp\malremtool.exeFilesize
609KB
MD5a79bcc830c8a002cd5f71abf9edbff95
SHA14c4846f81fd2b5758c81e7715d46d053cd5fa512
SHA256845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab
SHA512c233a41bee6ced3995380e13c4d7f39436465a479924644c5cf2c7e7a5f31d9c8928388d380844d507666237bb4fc387bffe4415b24f5a457ad06ffff46f214b
-
\Users\Admin\AppData\Local\Temp\malremtool.exeFilesize
609KB
MD5a79bcc830c8a002cd5f71abf9edbff95
SHA14c4846f81fd2b5758c81e7715d46d053cd5fa512
SHA256845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab
SHA512c233a41bee6ced3995380e13c4d7f39436465a479924644c5cf2c7e7a5f31d9c8928388d380844d507666237bb4fc387bffe4415b24f5a457ad06ffff46f214b
-
\Users\Admin\AppData\Local\Temp\malremtool.exeFilesize
609KB
MD5a79bcc830c8a002cd5f71abf9edbff95
SHA14c4846f81fd2b5758c81e7715d46d053cd5fa512
SHA256845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab
SHA512c233a41bee6ced3995380e13c4d7f39436465a479924644c5cf2c7e7a5f31d9c8928388d380844d507666237bb4fc387bffe4415b24f5a457ad06ffff46f214b
-
\Users\Admin\AppData\Local\Temp\malremtool.exeFilesize
609KB
MD5a79bcc830c8a002cd5f71abf9edbff95
SHA14c4846f81fd2b5758c81e7715d46d053cd5fa512
SHA256845f86a5cd28446fc64d66e134a36182d49326686eee64aa6a0131f36d51aaab
SHA512c233a41bee6ced3995380e13c4d7f39436465a479924644c5cf2c7e7a5f31d9c8928388d380844d507666237bb4fc387bffe4415b24f5a457ad06ffff46f214b
-
memory/900-60-0x0000000000000000-mapping.dmp
-
memory/1932-54-0x0000000076831000-0x0000000076833000-memory.dmpFilesize
8KB
-
memory/1932-55-0x0000000000400000-0x000000000049F8A0-memory.dmpFilesize
638KB