Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01-12-2023 14:28
Behavioral task
behavioral1
Sample
Rybkdr.exe
Resource
win7-20231023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Rybkdr.exe
Resource
win10v2004-20231127-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Rybkdr.exe
-
Size
1.1MB
-
MD5
d6393631100d7160ca348397cb01943d
-
SHA1
3ff0803ae9fd31efc74bcb29006c1cbf29b03f75
-
SHA256
eea977d6c736325a557a0c31552c49c51399748fc138db772735109fb6510757
-
SHA512
efef9bd64c68757c762a2fdbeb21cc6fc504b85dfd4f468b13504b00b365b58cd83aad3dbbc1cc12c8688d74777d69d6e09685cc9310a0cd29885f6a74fea576
-
SSDEEP
24576:X1uC5JT92RkNSIXtzdf1ZOS0e42xWVYknV3G/Z:AKfRdtsS0e4GIV3GR
Score
10/10
Malware Config
Signatures
-
Detect PureLogs payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2236-0-0x0000000000360000-0x0000000000486000-memory.dmp family_purelogs -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Rybkdr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pwdhqxrq = "C:\\Users\\Admin\\AppData\\Roaming\\Pwdhqxrq.exe" Rybkdr.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Rybkdr.exepid process 2236 Rybkdr.exe 2236 Rybkdr.exe 2236 Rybkdr.exe 2236 Rybkdr.exe 2236 Rybkdr.exe 2236 Rybkdr.exe 2236 Rybkdr.exe 2236 Rybkdr.exe 2236 Rybkdr.exe 2236 Rybkdr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Rybkdr.exedescription pid process Token: SeDebugPrivilege 2236 Rybkdr.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
Rybkdr.exedescription pid process target process PID 2236 wrote to memory of 2820 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2820 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2820 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2820 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1084 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1084 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1084 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1084 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2032 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2032 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2032 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2032 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1064 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1064 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1064 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1064 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2352 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2352 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2352 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2352 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1976 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1976 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1976 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 1976 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2624 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2624 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2624 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2624 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2604 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2604 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2604 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2604 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2696 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2696 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2696 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2696 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2712 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2712 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2712 2236 Rybkdr.exe Rybkdr.exe PID 2236 wrote to memory of 2712 2236 Rybkdr.exe Rybkdr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exe"C:\Users\Admin\AppData\Local\Temp\Rybkdr.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\Rybkdr.exeC:\Users\Admin\AppData\Local\Temp\Rybkdr.exe2⤵PID:2712