56599180a87b35be3e8652362b67f17bc09723f2e721a5b1eedacf81c217463b

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56599180a87b35be3e8652362b67f17bc09723f2e721a5b1eedacf81c217463b.exe
Size

4.8MB
MD5

601152041349ea4058cbf402d1fd0bf8
SHA1

86ac33ad049aa26bc7e999b545b7c48c8ebff62b
SHA256

56599180a87b35be3e8652362b67f17bc09723f2e721a5b1eedacf81c217463b
SHA512

67e77852ba83618f7f7c24aa3f6bdc0eb62801eef1893505d53bbf2679da9c571007427025483d25b835c801006bcffc15a72d75d09b8832a0133cffb2451599
SSDEEP

98304:odpMFRfU4UiMXFNMsO/yhI97HHvFR3AQEhzal4buoOjKBjEiNkp7e:op8R4Os2KMTvFi/h+lW84j4p7e

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3892	is-SVEFA.tmp
4896	BBuster.exe
1224	BBuster.exe

Loads dropped DLL 1 IoCs

pid	Process
3892	is-SVEFA.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	51.159.66.125

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BBuster\Lang\is-BK1S4.tmp	is-SVEFA.tmp
File opened for modification	C:\Program Files (x86)\BBuster\BBuster.exe	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-QNSBT.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-0B6PP.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-F5LK6.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-QIM0I.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-MFMBK.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Help\is-1VF82.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Plugins\is-D518S.tmp	is-SVEFA.tmp
File opened for modification	C:\Program Files (x86)\BBuster\unins000.dat	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\is-M70R0.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-H52I3.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-I8JSV.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-44H82.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Online\is-V75RS.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Plugins\is-PFUS8.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\unins000.dat	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-2MLOU.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-KSN59.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-9HAG0.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-RJKT0.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-CGMPT.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-LN9ST.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-P5CAB.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Plugins\is-J5ECI.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Plugins\is-5N4VA.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\is-ISM3Q.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-K58UU.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-985E2.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-IEBIM.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Online\is-UFDC1.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-E2T8V.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-7J1ME.tmp	is-SVEFA.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-33DVM.tmp	is-SVEFA.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3892	4636	56599180a87b35be3e8652362b67f17bc09723f2e721a5b1eedacf81c217463b.exe	84
PID 4636 wrote to memory of 3892	4636	56599180a87b35be3e8652362b67f17bc09723f2e721a5b1eedacf81c217463b.exe	84
PID 4636 wrote to memory of 3892	4636	56599180a87b35be3e8652362b67f17bc09723f2e721a5b1eedacf81c217463b.exe	84
PID 3892 wrote to memory of 1552	3892	is-SVEFA.tmp	87
PID 3892 wrote to memory of 1552	3892	is-SVEFA.tmp	87
PID 3892 wrote to memory of 1552	3892	is-SVEFA.tmp	87
PID 3892 wrote to memory of 4896	3892	is-SVEFA.tmp	89
PID 3892 wrote to memory of 4896	3892	is-SVEFA.tmp	89
PID 3892 wrote to memory of 4896	3892	is-SVEFA.tmp	89
PID 1552 wrote to memory of 3428	1552	net.exe	90
PID 1552 wrote to memory of 3428	1552	net.exe	90
PID 1552 wrote to memory of 3428	1552	net.exe	90
PID 3892 wrote to memory of 1224	3892	is-SVEFA.tmp	91
PID 3892 wrote to memory of 1224	3892	is-SVEFA.tmp	91
PID 3892 wrote to memory of 1224	3892	is-SVEFA.tmp	91

C:\Users\Admin\AppData\Local\Temp\56599180a87b35be3e8652362b67f17bc09723f2e721a5b1eedacf81c217463b.exe
"C:\Users\Admin\AppData\Local\Temp\56599180a87b35be3e8652362b67f17bc09723f2e721a5b1eedacf81c217463b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\is-O680E.tmp\is-SVEFA.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O680E.tmp\is-SVEFA.tmp" /SL4 $21003C "C:\Users\Admin\AppData\Local\Temp\56599180a87b35be3e8652362b67f17bc09723f2e721a5b1eedacf81c217463b.exe" 4716728 79360
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 3
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 3
      4⤵
      PID:3428
- - C:\Program Files (x86)\BBuster\BBuster.exe
    "C:\Program Files (x86)\BBuster\BBuster.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4896
- - C:\Program Files (x86)\BBuster\BBuster.exe
    "C:\Program Files (x86)\BBuster\BBuster.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\BBuster\BBuster.exe

Filesize
3.7MB

MD5
b02f39d5b067396dc07365240d58e5e9

SHA1
c7271fe880e08b4b62376249ec48ec7e2402310f

SHA256
0dc92952657fda926cf39b6139c0a91700a142f200f216b887672b6f21cef802

SHA512
f0963353c00000ab82a91447917aa4522de5b35cdb5b4844651410457f6eda7cf4764421f8aebe4389f38083837b1433043adce60dbbcf027b37e7dc5174ed54

Download Submit
C:\Program Files (x86)\BBuster\BBuster.exe

Filesize
3.7MB

MD5
b02f39d5b067396dc07365240d58e5e9

SHA1
c7271fe880e08b4b62376249ec48ec7e2402310f

SHA256
0dc92952657fda926cf39b6139c0a91700a142f200f216b887672b6f21cef802

SHA512
f0963353c00000ab82a91447917aa4522de5b35cdb5b4844651410457f6eda7cf4764421f8aebe4389f38083837b1433043adce60dbbcf027b37e7dc5174ed54

Download Submit
C:\Program Files (x86)\BBuster\BBuster.exe

Filesize
3.7MB

MD5
b02f39d5b067396dc07365240d58e5e9

SHA1
c7271fe880e08b4b62376249ec48ec7e2402310f

SHA256
0dc92952657fda926cf39b6139c0a91700a142f200f216b887672b6f21cef802

SHA512
f0963353c00000ab82a91447917aa4522de5b35cdb5b4844651410457f6eda7cf4764421f8aebe4389f38083837b1433043adce60dbbcf027b37e7dc5174ed54

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C3ELL.tmp\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O680E.tmp\is-SVEFA.tmp

Filesize
643KB

MD5
a991510c12f20ccf8a5231a32a7958c3

SHA1
122724d1a4fdea39af3aa427e4941158d7e91dfa

SHA256
0c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198

SHA512
8f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O680E.tmp\is-SVEFA.tmp

Filesize
643KB

MD5
a991510c12f20ccf8a5231a32a7958c3

SHA1
122724d1a4fdea39af3aa427e4941158d7e91dfa

SHA256
0c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198

SHA512
8f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa

Download Submit
memory/1224-121-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-124-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-142-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-139-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-135-0x00000000028D0000-0x0000000002979000-memory.dmp

Filesize
676KB

Download
memory/1224-134-0x00000000028D0000-0x0000000002979000-memory.dmp

Filesize
676KB

Download
memory/1224-90-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-133-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-130-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-127-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-95-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-96-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-99-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-102-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-105-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-108-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-111-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-113-0x00000000028D0000-0x0000000002979000-memory.dmp

Filesize
676KB

Download
memory/1224-112-0x00000000028D0000-0x0000000002979000-memory.dmp

Filesize
676KB

Download
memory/1224-117-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/1224-118-0x00000000028D0000-0x0000000002979000-memory.dmp

Filesize
676KB

Download
memory/3892-94-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3892-92-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3892-7-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/4636-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4636-91-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4896-82-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/4896-87-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/4896-86-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download
memory/4896-84-0x0000000000400000-0x00000000007C2000-memory.dmp

Filesize
3.8MB

Download