Analysis
-
max time kernel
130s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 19:36
Static task
static1
Behavioral task
behavioral1
Sample
28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
Resource
win7-20221111-en
General
-
Target
28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe
-
Size
901KB
-
MD5
a6e9ff0cd09cbe50096fdf30aed057aa
-
SHA1
678f76dab9b7e0f0ef1a0917b2fad5e10b16a23a
-
SHA256
28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff
-
SHA512
3ac902f1a0d0e13ad379dd8ed318fb29becd77068b6dc268ec699696bd843f8fbe34e41fd0b770e373d1f0478c8850f49bf3f9f56efa84e0fc9df1fc0294a78f
-
SSDEEP
24576:wh7qXY/21x+kdEvWft7Wsfogur37HuXIqQ:wtp21QkdE+Zbf4+XIqQ
Malware Config
Signatures
-
DarkVNC payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4640-143-0x0000000002A00000-0x0000000002A89000-memory.dmp darkvnc behavioral2/memory/4640-149-0x00000000031C0000-0x0000000003300000-memory.dmp darkvnc behavioral2/memory/2604-150-0x00000294EC8D0000-0x00000294EC999000-memory.dmp darkvnc behavioral2/memory/2604-151-0x00000294EC8D0000-0x00000294EC999000-memory.dmp darkvnc -
Suspicious use of SetThreadContext 2 IoCs
Processes:
28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exedescription pid process target process PID 5052 set thread context of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 4640 set thread context of 2604 4640 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exepid process 4640 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exepid process 4640 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exedescription pid process target process PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 5052 wrote to memory of 4640 5052 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe PID 4640 wrote to memory of 2604 4640 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe WerFault.exe PID 4640 wrote to memory of 2604 4640 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe WerFault.exe PID 4640 wrote to memory of 2604 4640 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe WerFault.exe PID 4640 wrote to memory of 2604 4640 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe WerFault.exe PID 4640 wrote to memory of 2604 4640 28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe"C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\28537d41a0ef3e2bb3ba3419804d6f13070415190de476aaadca000b6af2fdff.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2604-146-0x0000000000000000-mapping.dmp
-
memory/2604-151-0x00000294EC8D0000-0x00000294EC999000-memory.dmpFilesize
804KB
-
memory/2604-150-0x00000294EC8D0000-0x00000294EC999000-memory.dmpFilesize
804KB
-
memory/4640-147-0x0000000000401000-0x000000000044A000-memory.dmpFilesize
292KB
-
memory/4640-143-0x0000000002A00000-0x0000000002A89000-memory.dmpFilesize
548KB
-
memory/4640-137-0x0000000000000000-mapping.dmp
-
memory/4640-138-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4640-140-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4640-141-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4640-142-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4640-149-0x00000000031C0000-0x0000000003300000-memory.dmpFilesize
1.2MB
-
memory/4640-148-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/5052-132-0x0000000000D20000-0x0000000000DFC000-memory.dmpFilesize
880KB
-
memory/5052-135-0x00000000057B0000-0x00000000057BA000-memory.dmpFilesize
40KB
-
memory/5052-136-0x0000000008FF0000-0x000000000908C000-memory.dmpFilesize
624KB
-
memory/5052-134-0x00000000057F0000-0x0000000005882000-memory.dmpFilesize
584KB
-
memory/5052-133-0x0000000005ED0000-0x0000000006474000-memory.dmpFilesize
5.6MB