Analysis
-
max time kernel
251s -
max time network
331s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2022 13:40
Static task
static1
Behavioral task
behavioral1
Sample
103.133.110.147_-_outlook_-_vbc.exe___2b087c00777a630a4100c122f4687783.exe
Resource
win7-20220812-en
General
-
Target
103.133.110.147_-_outlook_-_vbc.exe___2b087c00777a630a4100c122f4687783.exe
-
Size
334KB
-
MD5
2b087c00777a630a4100c122f4687783
-
SHA1
618f5bf8bea9d2c431c4389c18e2dd91082a0d67
-
SHA256
12a921f6abb929d4f8b28924868dcc468299e44745c37db3aa7e4ac9bfe38869
-
SHA512
cb47508cf530de56e1c2317351eca84b832d431a516c4da2676855e6d76fc6d06b4b328d4c7ece2ff7ccc54acf04644a1f30e4e8b8067dc9889f4a7a32eaa37b
-
SSDEEP
6144:QBn1W74u851+xu+La/EZ4sAR7Im/VvQgUJ5IBjiIQ1XhXXMaXTEZ2iaH4hY:gW7OgxLLaE2R7IwY5MjinzEoPHKY
Malware Config
Extracted
formbook
henz
IxWMb+jVsoinShuZJzk=
TPfKgQZ//oGnKr/J
EsK0WxD5kY65XOW1Td/5CxSUpCUytR7M
KebSmiCP9p8yUw==
HAt/ljkEuqMLHOLCi53Pv8MKX9qk
CY4ogZTwJc4vSw==
WWDIx5UYUDyepntE0YIAPca3/rI=
+Pkr01Lfb2rME7bL
S5nyK0p8jS2xdwQ=
W/oqvlO57LfkLcLHnQ==
zrrwtqkTLwxulm4l8FGopw==
AqucYext8bzFbOKthIm8E6gfVkUHxKY=
OfnjeDs78+RTcz4OHRl+
XKf1wwpZR5hLLjHgmUGOpQ==
JMyhSLoJPTCwn5o9zX2d8i1+
Wk54MBsDhWSVbnIRkQ==
7aaYR/tOhh9piTw5/KHSRwuK2iqgafw7pQ==
hH/EYxN+jC2xdwQ=
S0F4ORqDjS2xdwQ=
0o/UwXnuJ+sJp0cOHRl+
klE+E/jVelhT72wOHRl+
ZGvqyzaT9qfME7bL
czgajHaygm4=
KufYeyTiLhIGlzU6/38IM7IrqzhFa64=
oVNF+2VXWBL9jwGsK3Bw5TE=
iI3g6JaEalRvMDaz8AD4+vt0
nWtRAaSccRlLVg==
NtvDoS2UMcMRSA==
1t5MW/lEfjsUrFJeGXBw5TE=
UFixmi+P2cgqPRj09Sc=
MSuTonT5QhU11IGFYWKB6eJj
k4Lw3r+hTj9NF8+zgnu+Nsa3/rI=
NSN7fCqHln/S+RuZJzk=
dTUV1GY97NlVLsaSJXBw5TE=
8u5OLgNPRShyRRuZJzk=
BLTZ0G3iV0B5PvedL3Bw5TE=
ci8Y27nGCM69
JxF8W9/QoC2xdwQ=
KusZC8MsPClL1oMo8SA=
tW9XIP/VYTmVpWIDjIu1p5/ebhC9
pmc//mhFFgx3l1IOHRl+
MOsl9G5hQT6lhc0oLHWtrQ==
fXvSx46RRSiGjWphOnO0p8a3/rI=
D8Hx4JoDG+znbnIRkQ==
Dsfu2pqFJP0Kv0gX1CGX3Sw=
FcGnEr4fhW7ME7bL
hkc37Y3GF8gTMAw=
dnGZWjqPqYqgTxuZJzk=
iDEV43sIvE1j7psMiQ==
vb8qEoNQBus+mQXst1h2
46qCRt3j3cfneiudJjE=
8eoYvzW2PgDrffLWrav++Mf1TUUHxKY=
vqkFDa0HYztZ+G8ODZ7Qug==
+K/F0qEnTxACrzMR2OocXxecmq31afw7pQ==
Egwn/u1rq2uVbnIRkQ==
nFVH/3fvalaRbnIRkQ==
CvtveEUyyqUJLOiOKnBw5TE=
dmfN5LErTj9l/Icl8FGopw==
VAQtEMawYiNPaTxLIxdbpD9sZL0=
MBSMhSCOHdpCVQ==
jz95eCeaJc4vSw==
85N/Gcy+XicYq0cOHRl+
D/1B46soVTKObnIRkQ==
Hgytgwn25KqyVRuZJzk=
brennancorps.info
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
rbygg.exerbygg.exepid process 4504 rbygg.exe 1388 rbygg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rbygg.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation rbygg.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
rbygg.exerbygg.execmmon32.exedescription pid process target process PID 4504 set thread context of 1388 4504 rbygg.exe rbygg.exe PID 1388 set thread context of 676 1388 rbygg.exe Explorer.EXE PID 1388 set thread context of 676 1388 rbygg.exe Explorer.EXE PID 2736 set thread context of 676 2736 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
rbygg.execmmon32.exepid process 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 2736 cmmon32.exe 2736 cmmon32.exe 2736 cmmon32.exe 2736 cmmon32.exe 2736 cmmon32.exe 2736 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 676 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
rbygg.exerbygg.execmmon32.exepid process 4504 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 1388 rbygg.exe 2736 cmmon32.exe 2736 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
rbygg.exeExplorer.EXEcmmon32.exedescription pid process Token: SeDebugPrivilege 1388 rbygg.exe Token: SeShutdownPrivilege 676 Explorer.EXE Token: SeCreatePagefilePrivilege 676 Explorer.EXE Token: SeDebugPrivilege 2736 cmmon32.exe Token: SeShutdownPrivilege 676 Explorer.EXE Token: SeCreatePagefilePrivilege 676 Explorer.EXE Token: SeShutdownPrivilege 676 Explorer.EXE Token: SeCreatePagefilePrivilege 676 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
103.133.110.147_-_outlook_-_vbc.exe___2b087c00777a630a4100c122f4687783.exerbygg.exeExplorer.EXEdescription pid process target process PID 396 wrote to memory of 4504 396 103.133.110.147_-_outlook_-_vbc.exe___2b087c00777a630a4100c122f4687783.exe rbygg.exe PID 396 wrote to memory of 4504 396 103.133.110.147_-_outlook_-_vbc.exe___2b087c00777a630a4100c122f4687783.exe rbygg.exe PID 396 wrote to memory of 4504 396 103.133.110.147_-_outlook_-_vbc.exe___2b087c00777a630a4100c122f4687783.exe rbygg.exe PID 4504 wrote to memory of 1388 4504 rbygg.exe rbygg.exe PID 4504 wrote to memory of 1388 4504 rbygg.exe rbygg.exe PID 4504 wrote to memory of 1388 4504 rbygg.exe rbygg.exe PID 4504 wrote to memory of 1388 4504 rbygg.exe rbygg.exe PID 676 wrote to memory of 2736 676 Explorer.EXE cmmon32.exe PID 676 wrote to memory of 2736 676 Explorer.EXE cmmon32.exe PID 676 wrote to memory of 2736 676 Explorer.EXE cmmon32.exe PID 676 wrote to memory of 2384 676 Explorer.EXE msdt.exe PID 676 wrote to memory of 2384 676 Explorer.EXE msdt.exe PID 676 wrote to memory of 2384 676 Explorer.EXE msdt.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\103.133.110.147_-_outlook_-_vbc.exe___2b087c00777a630a4100c122f4687783.exe"C:\Users\Admin\AppData\Local\Temp\103.133.110.147_-_outlook_-_vbc.exe___2b087c00777a630a4100c122f4687783.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\rbygg.exe"C:\Users\Admin\AppData\Local\Temp\rbygg.exe" C:\Users\Admin\AppData\Local\Temp\kddircpspqa.tkt3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\rbygg.exe"C:\Users\Admin\AppData\Local\Temp\rbygg.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1388 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵PID:2384
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2736
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\kddircpspqa.tktFilesize
5KB
MD55def413bb305e22659152545633d4394
SHA1ea186096bc4445be3a749bfe98ff1549f822da5e
SHA25669ac40a2aeebad2a280bb794d8a8f0a2e2d195739b6317d4f94897bc22a51309
SHA512e4917aced9bae7c29d4bb553a8675596719c8ff5e39cd8f034ae897197fd662b596b013311d010b9282fa269ae03fdc6aba27c2e84ba9f350771ff7a022e2144
-
C:\Users\Admin\AppData\Local\Temp\rbygg.exeFilesize
267KB
MD58dcd475914550c7b97c0692d42b0b5cc
SHA107f9a2e01086f31881d2b46447a30032ddaf1b75
SHA256408c5d65bd00332fcc1fcdfd1b01e6bcea3ec07d236f2d203977d824c76cdcf4
SHA5125e2f68ba27ef5c5749826e3a7483e3920a5c43101cb8c6d117567d6bae7b87d23b0090e5b75213481b9a0ee1c10b4e437982d8d9de56fce0b37b3e590dd10a23
-
C:\Users\Admin\AppData\Local\Temp\rbygg.exeFilesize
267KB
MD58dcd475914550c7b97c0692d42b0b5cc
SHA107f9a2e01086f31881d2b46447a30032ddaf1b75
SHA256408c5d65bd00332fcc1fcdfd1b01e6bcea3ec07d236f2d203977d824c76cdcf4
SHA5125e2f68ba27ef5c5749826e3a7483e3920a5c43101cb8c6d117567d6bae7b87d23b0090e5b75213481b9a0ee1c10b4e437982d8d9de56fce0b37b3e590dd10a23
-
C:\Users\Admin\AppData\Local\Temp\rbygg.exeFilesize
267KB
MD58dcd475914550c7b97c0692d42b0b5cc
SHA107f9a2e01086f31881d2b46447a30032ddaf1b75
SHA256408c5d65bd00332fcc1fcdfd1b01e6bcea3ec07d236f2d203977d824c76cdcf4
SHA5125e2f68ba27ef5c5749826e3a7483e3920a5c43101cb8c6d117567d6bae7b87d23b0090e5b75213481b9a0ee1c10b4e437982d8d9de56fce0b37b3e590dd10a23
-
C:\Users\Admin\AppData\Local\Temp\wiidn.oFilesize
185KB
MD5c985ca943df871d4ca23679cb7be7dd7
SHA1a6d315d44a90d685deb4eea6c6778ed2e5f0f575
SHA2562b159ae78ee415b70683cbc5fc7d479b9dc62c127d98afa021f10824ca8fb8ab
SHA5125d471a2a84751b756863e4766f7ec1f288c08482ac365e90726501dc385a99da72a6b7104e7dfeb365926997c7df1aa22f9f9c8b343ed60d53ed868b3e8933c4
-
memory/676-163-0x00000000009A0000-0x00000000009B0000-memory.dmpFilesize
64KB
-
memory/676-160-0x00000000009A0000-0x00000000009B0000-memory.dmpFilesize
64KB
-
memory/676-164-0x00000000009A0000-0x00000000009B0000-memory.dmpFilesize
64KB
-
memory/676-153-0x0000000008830000-0x000000000896F000-memory.dmpFilesize
1.2MB
-
memory/676-162-0x00000000009A0000-0x00000000009B0000-memory.dmpFilesize
64KB
-
memory/676-161-0x0000000008830000-0x000000000896F000-memory.dmpFilesize
1.2MB
-
memory/676-143-0x0000000008990000-0x0000000008AE2000-memory.dmpFilesize
1.3MB
-
memory/676-165-0x00000000009A0000-0x00000000009B0000-memory.dmpFilesize
64KB
-
memory/676-145-0x0000000008C70000-0x0000000008E0F000-memory.dmpFilesize
1.6MB
-
memory/676-159-0x00000000009A0000-0x00000000009B0000-memory.dmpFilesize
64KB
-
memory/676-158-0x00000000009A0000-0x00000000009B0000-memory.dmpFilesize
64KB
-
memory/676-157-0x0000000000E70000-0x0000000000E80000-memory.dmpFilesize
64KB
-
memory/676-156-0x00000000009A0000-0x00000000009B0000-memory.dmpFilesize
64KB
-
memory/676-155-0x0000000000E70000-0x0000000000E80000-memory.dmpFilesize
64KB
-
memory/1388-140-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1388-142-0x0000000000B40000-0x0000000000B50000-memory.dmpFilesize
64KB
-
memory/1388-137-0x0000000000000000-mapping.dmp
-
memory/1388-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1388-141-0x0000000001200000-0x000000000154A000-memory.dmpFilesize
3.3MB
-
memory/1388-144-0x0000000000CD0000-0x0000000000CE0000-memory.dmpFilesize
64KB
-
memory/1388-148-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1388-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2736-146-0x0000000000000000-mapping.dmp
-
memory/2736-149-0x0000000000330000-0x000000000033C000-memory.dmpFilesize
48KB
-
memory/2736-152-0x0000000002BC0000-0x0000000002C4F000-memory.dmpFilesize
572KB
-
memory/2736-150-0x0000000000E40000-0x0000000000E6D000-memory.dmpFilesize
180KB
-
memory/2736-154-0x0000000000E40000-0x0000000000E6D000-memory.dmpFilesize
180KB
-
memory/2736-151-0x0000000002F20000-0x000000000326A000-memory.dmpFilesize
3.3MB
-
memory/4504-132-0x0000000000000000-mapping.dmp