Analysis
-
max time kernel
331s -
max time network
408s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 12:48
Static task
static1
Behavioral task
behavioral1
Sample
2b087c00777a630a4100c122f4687783.exe
Resource
win7-20221111-en
General
-
Target
2b087c00777a630a4100c122f4687783.exe
-
Size
334KB
-
MD5
2b087c00777a630a4100c122f4687783
-
SHA1
618f5bf8bea9d2c431c4389c18e2dd91082a0d67
-
SHA256
12a921f6abb929d4f8b28924868dcc468299e44745c37db3aa7e4ac9bfe38869
-
SHA512
cb47508cf530de56e1c2317351eca84b832d431a516c4da2676855e6d76fc6d06b4b328d4c7ece2ff7ccc54acf04644a1f30e4e8b8067dc9889f4a7a32eaa37b
-
SSDEEP
6144:QBn1W74u851+xu+La/EZ4sAR7Im/VvQgUJ5IBjiIQ1XhXXMaXTEZ2iaH4hY:gW7OgxLLaE2R7IwY5MjinzEoPHKY
Malware Config
Extracted
formbook
henz
IxWMb+jVsoinShuZJzk=
TPfKgQZ//oGnKr/J
EsK0WxD5kY65XOW1Td/5CxSUpCUytR7M
KebSmiCP9p8yUw==
HAt/ljkEuqMLHOLCi53Pv8MKX9qk
CY4ogZTwJc4vSw==
WWDIx5UYUDyepntE0YIAPca3/rI=
+Pkr01Lfb2rME7bL
S5nyK0p8jS2xdwQ=
W/oqvlO57LfkLcLHnQ==
zrrwtqkTLwxulm4l8FGopw==
AqucYext8bzFbOKthIm8E6gfVkUHxKY=
OfnjeDs78+RTcz4OHRl+
XKf1wwpZR5hLLjHgmUGOpQ==
JMyhSLoJPTCwn5o9zX2d8i1+
Wk54MBsDhWSVbnIRkQ==
7aaYR/tOhh9piTw5/KHSRwuK2iqgafw7pQ==
hH/EYxN+jC2xdwQ=
S0F4ORqDjS2xdwQ=
0o/UwXnuJ+sJp0cOHRl+
klE+E/jVelhT72wOHRl+
ZGvqyzaT9qfME7bL
czgajHaygm4=
KufYeyTiLhIGlzU6/38IM7IrqzhFa64=
oVNF+2VXWBL9jwGsK3Bw5TE=
iI3g6JaEalRvMDaz8AD4+vt0
nWtRAaSccRlLVg==
NtvDoS2UMcMRSA==
1t5MW/lEfjsUrFJeGXBw5TE=
UFixmi+P2cgqPRj09Sc=
MSuTonT5QhU11IGFYWKB6eJj
k4Lw3r+hTj9NF8+zgnu+Nsa3/rI=
NSN7fCqHln/S+RuZJzk=
dTUV1GY97NlVLsaSJXBw5TE=
8u5OLgNPRShyRRuZJzk=
BLTZ0G3iV0B5PvedL3Bw5TE=
ci8Y27nGCM69
JxF8W9/QoC2xdwQ=
KusZC8MsPClL1oMo8SA=
tW9XIP/VYTmVpWIDjIu1p5/ebhC9
pmc//mhFFgx3l1IOHRl+
MOsl9G5hQT6lhc0oLHWtrQ==
fXvSx46RRSiGjWphOnO0p8a3/rI=
D8Hx4JoDG+znbnIRkQ==
Dsfu2pqFJP0Kv0gX1CGX3Sw=
FcGnEr4fhW7ME7bL
hkc37Y3GF8gTMAw=
dnGZWjqPqYqgTxuZJzk=
iDEV43sIvE1j7psMiQ==
vb8qEoNQBus+mQXst1h2
46qCRt3j3cfneiudJjE=
8eoYvzW2PgDrffLWrav++Mf1TUUHxKY=
vqkFDa0HYztZ+G8ODZ7Qug==
+K/F0qEnTxACrzMR2OocXxecmq31afw7pQ==
Egwn/u1rq2uVbnIRkQ==
nFVH/3fvalaRbnIRkQ==
CvtveEUyyqUJLOiOKnBw5TE=
dmfN5LErTj9l/Icl8FGopw==
VAQtEMawYiNPaTxLIxdbpD9sZL0=
MBSMhSCOHdpCVQ==
jz95eCeaJc4vSw==
85N/Gcy+XicYq0cOHRl+
D/1B46soVTKObnIRkQ==
Hgytgwn25KqyVRuZJzk=
brennancorps.info
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
rbygg.exerbygg.exepid process 1740 rbygg.exe 1028 rbygg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rbygg.exedescription pid process target process PID 1740 set thread context of 1028 1740 rbygg.exe rbygg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rbygg.exepid process 1028 rbygg.exe 1028 rbygg.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
rbygg.exepid process 1740 rbygg.exe 1740 rbygg.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2b087c00777a630a4100c122f4687783.exerbygg.exedescription pid process target process PID 1864 wrote to memory of 1740 1864 2b087c00777a630a4100c122f4687783.exe rbygg.exe PID 1864 wrote to memory of 1740 1864 2b087c00777a630a4100c122f4687783.exe rbygg.exe PID 1864 wrote to memory of 1740 1864 2b087c00777a630a4100c122f4687783.exe rbygg.exe PID 1740 wrote to memory of 1028 1740 rbygg.exe rbygg.exe PID 1740 wrote to memory of 1028 1740 rbygg.exe rbygg.exe PID 1740 wrote to memory of 1028 1740 rbygg.exe rbygg.exe PID 1740 wrote to memory of 1028 1740 rbygg.exe rbygg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b087c00777a630a4100c122f4687783.exe"C:\Users\Admin\AppData\Local\Temp\2b087c00777a630a4100c122f4687783.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rbygg.exe"C:\Users\Admin\AppData\Local\Temp\rbygg.exe" C:\Users\Admin\AppData\Local\Temp\kddircpspqa.tkt2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rbygg.exe"C:\Users\Admin\AppData\Local\Temp\rbygg.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\kddircpspqa.tktFilesize
5KB
MD55def413bb305e22659152545633d4394
SHA1ea186096bc4445be3a749bfe98ff1549f822da5e
SHA25669ac40a2aeebad2a280bb794d8a8f0a2e2d195739b6317d4f94897bc22a51309
SHA512e4917aced9bae7c29d4bb553a8675596719c8ff5e39cd8f034ae897197fd662b596b013311d010b9282fa269ae03fdc6aba27c2e84ba9f350771ff7a022e2144
-
C:\Users\Admin\AppData\Local\Temp\rbygg.exeFilesize
267KB
MD58dcd475914550c7b97c0692d42b0b5cc
SHA107f9a2e01086f31881d2b46447a30032ddaf1b75
SHA256408c5d65bd00332fcc1fcdfd1b01e6bcea3ec07d236f2d203977d824c76cdcf4
SHA5125e2f68ba27ef5c5749826e3a7483e3920a5c43101cb8c6d117567d6bae7b87d23b0090e5b75213481b9a0ee1c10b4e437982d8d9de56fce0b37b3e590dd10a23
-
C:\Users\Admin\AppData\Local\Temp\rbygg.exeFilesize
267KB
MD58dcd475914550c7b97c0692d42b0b5cc
SHA107f9a2e01086f31881d2b46447a30032ddaf1b75
SHA256408c5d65bd00332fcc1fcdfd1b01e6bcea3ec07d236f2d203977d824c76cdcf4
SHA5125e2f68ba27ef5c5749826e3a7483e3920a5c43101cb8c6d117567d6bae7b87d23b0090e5b75213481b9a0ee1c10b4e437982d8d9de56fce0b37b3e590dd10a23
-
C:\Users\Admin\AppData\Local\Temp\rbygg.exeFilesize
267KB
MD58dcd475914550c7b97c0692d42b0b5cc
SHA107f9a2e01086f31881d2b46447a30032ddaf1b75
SHA256408c5d65bd00332fcc1fcdfd1b01e6bcea3ec07d236f2d203977d824c76cdcf4
SHA5125e2f68ba27ef5c5749826e3a7483e3920a5c43101cb8c6d117567d6bae7b87d23b0090e5b75213481b9a0ee1c10b4e437982d8d9de56fce0b37b3e590dd10a23
-
C:\Users\Admin\AppData\Local\Temp\wiidn.oFilesize
185KB
MD5c985ca943df871d4ca23679cb7be7dd7
SHA1a6d315d44a90d685deb4eea6c6778ed2e5f0f575
SHA2562b159ae78ee415b70683cbc5fc7d479b9dc62c127d98afa021f10824ca8fb8ab
SHA5125d471a2a84751b756863e4766f7ec1f288c08482ac365e90726501dc385a99da72a6b7104e7dfeb365926997c7df1aa22f9f9c8b343ed60d53ed868b3e8933c4
-
memory/1028-137-0x0000000000000000-mapping.dmp
-
memory/1028-139-0x0000000000350000-0x000000000037F000-memory.dmpFilesize
188KB
-
memory/1028-140-0x0000000000C70000-0x0000000000FBA000-memory.dmpFilesize
3.3MB
-
memory/1740-132-0x0000000000000000-mapping.dmp