6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

General

Target

bdd1438c98225e3ea172ec284a6708f9.exe
Size

1.5MB
MD5

bdd1438c98225e3ea172ec284a6708f9
SHA1

0d1e23278ef4346d2a051f35d4cecf30199e6eae
SHA256

6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c
SHA512

7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4
SSDEEP

49152:VU7EGUTipLZ+DYQ1dKrHIdbbwPk+1ddjjt2:C7EZG/+DYwdKrap+1d

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rttre.exe

pid process

1188 rttre.exe

pid	process
1188	rttre.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4120-138-0x0000000000500000-0x00000000008E4000-memory.dmp	upx
behavioral2/memory/4120-139-0x0000000000500000-0x00000000008E4000-memory.dmp	upx
behavioral2/memory/4120-140-0x0000000000500000-0x00000000008E4000-memory.dmp	upx
behavioral2/memory/4120-141-0x0000000000500000-0x00000000008E4000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

bdd1438c98225e3ea172ec284a6708f9.exe

description pid process target process

PID 2388 set thread context of 4120 2388 bdd1438c98225e3ea172ec284a6708f9.exe vbc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1876 4120 WerFault.exe vbc.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2636 schtasks.exe

description	pid	process	target process
PID 2388 set thread context of 4120	2388	bdd1438c98225e3ea172ec284a6708f9.exe	vbc.exe

pid	pid_target	process	target process
1876	4120	WerFault.exe	vbc.exe

pid	process
2636	schtasks.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

bdd1438c98225e3ea172ec284a6708f9.execmd.exe

description	pid	process	target process
PID 2388 wrote to memory of 4120	2388	bdd1438c98225e3ea172ec284a6708f9.exe	vbc.exe
PID 2388 wrote to memory of 4120	2388	bdd1438c98225e3ea172ec284a6708f9.exe	vbc.exe
PID 2388 wrote to memory of 4120	2388	bdd1438c98225e3ea172ec284a6708f9.exe	vbc.exe
PID 2388 wrote to memory of 4120	2388	bdd1438c98225e3ea172ec284a6708f9.exe	vbc.exe
PID 2388 wrote to memory of 4120	2388	bdd1438c98225e3ea172ec284a6708f9.exe	vbc.exe
PID 2388 wrote to memory of 4120	2388	bdd1438c98225e3ea172ec284a6708f9.exe	vbc.exe
PID 2388 wrote to memory of 4120	2388	bdd1438c98225e3ea172ec284a6708f9.exe	vbc.exe
PID 2388 wrote to memory of 3148	2388	bdd1438c98225e3ea172ec284a6708f9.exe	cmd.exe
PID 2388 wrote to memory of 3148	2388	bdd1438c98225e3ea172ec284a6708f9.exe	cmd.exe
PID 2388 wrote to memory of 3148	2388	bdd1438c98225e3ea172ec284a6708f9.exe	cmd.exe
PID 2388 wrote to memory of 4208	2388	bdd1438c98225e3ea172ec284a6708f9.exe	cmd.exe
PID 2388 wrote to memory of 4208	2388	bdd1438c98225e3ea172ec284a6708f9.exe	cmd.exe
PID 2388 wrote to memory of 4208	2388	bdd1438c98225e3ea172ec284a6708f9.exe	cmd.exe
PID 4208 wrote to memory of 2636	4208	cmd.exe	schtasks.exe
PID 4208 wrote to memory of 2636	4208	cmd.exe	schtasks.exe
PID 4208 wrote to memory of 2636	4208	cmd.exe	schtasks.exe
PID 2388 wrote to memory of 3488	2388	bdd1438c98225e3ea172ec284a6708f9.exe	cmd.exe
PID 2388 wrote to memory of 3488	2388	bdd1438c98225e3ea172ec284a6708f9.exe	cmd.exe
PID 2388 wrote to memory of 3488	2388	bdd1438c98225e3ea172ec284a6708f9.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\bdd1438c98225e3ea172ec284a6708f9.exe
"C:\Users\Admin\AppData\Local\Temp\bdd1438c98225e3ea172ec284a6708f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 188
3⤵
- Program crash
PID:1876

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\Temp\rttre"
2⤵
PID:3148

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4208

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe'" /f
3⤵
- Creates scheduled task(s)
PID:2636

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\bdd1438c98225e3ea172ec284a6708f9.exe" "C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe"
2⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4120 -ip 4120
1⤵
PID:3432

C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe
1⤵
- Executes dropped EXE
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe

Filesize
1.5MB

MD5
bdd1438c98225e3ea172ec284a6708f9

SHA1
0d1e23278ef4346d2a051f35d4cecf30199e6eae

SHA256
6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

SHA512
7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\rttre\rttre.exe

Filesize
1.5MB

MD5
bdd1438c98225e3ea172ec284a6708f9

SHA1
0d1e23278ef4346d2a051f35d4cecf30199e6eae

SHA256
6920c222d9646d2f191e93a2a0f5ea080615ddc88f0b65d18342eb335dfa480c

SHA512
7847f435bf73205fc0f2354c4d80c16d414f2f9076a5a725cbac2bd53d72b7b0f52c5e321d03915a1e9209e99006398d6208ef66c5e77190a256b9067ad2f3a4

Download Submit
memory/1188-148-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/2388-145-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/2388-137-0x00000000052E0000-0x00000000052F0000-memory.dmp

Filesize
64KB

Download
memory/2388-133-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/2388-136-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/2388-135-0x00000000052E0000-0x00000000052F0000-memory.dmp

Filesize
64KB

Download
memory/2388-134-0x00000000007F0000-0x000000000097A000-memory.dmp

Filesize
1.5MB

Download
memory/4120-138-0x0000000000500000-0x00000000008E4000-memory.dmp

Filesize
3.9MB

Download
memory/4120-139-0x0000000000500000-0x00000000008E4000-memory.dmp

Filesize
3.9MB

Download
memory/4120-140-0x0000000000500000-0x00000000008E4000-memory.dmp

Filesize
3.9MB

Download
memory/4120-141-0x0000000000500000-0x00000000008E4000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads