Analysis
-
max time kernel
11s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 07:57
Behavioral task
behavioral1
Sample
d147fad9c249b2817d91ea77c88be2d4.exe
Resource
win7-20231215-en
General
-
Target
d147fad9c249b2817d91ea77c88be2d4.exe
-
Size
1.4MB
-
MD5
d147fad9c249b2817d91ea77c88be2d4
-
SHA1
522d1bfaecf5180732c361fce27117e68e2f1ac3
-
SHA256
2ada77612f68d343b4bcf228680b62ec266d00475446059729ce9ab7c68a154b
-
SHA512
9daba4ceb7f2c4d2b1943528402266fede9984a24d1435774be8f25159817de9a1374faf78aefd0e365aaba853bf319717360fb02ef36566073d6d770166247b
-
SSDEEP
24576:/6yJMY9UFoRDhkeYM1jJR97zUbia9JVe0hs5WfBiERJchVML1bT6ES:yY9UORVOM1jJHzaiape0hsABFRJch6Lm
Malware Config
Signatures
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral2/memory/760-12-0x0000000005BF0000-0x0000000005C1C000-memory.dmp rezer0 -
Executes dropped EXE 1 IoCs
Processes:
test.exepid process 760 test.exe -
Processes:
resource yara_rule behavioral2/memory/4864-0-0x0000000000400000-0x00000000006F1000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d147fad9c249b2817d91ea77c88be2d4.execmd.exedescription pid process target process PID 4864 wrote to memory of 4808 4864 d147fad9c249b2817d91ea77c88be2d4.exe cmd.exe PID 4864 wrote to memory of 4808 4864 d147fad9c249b2817d91ea77c88be2d4.exe cmd.exe PID 4864 wrote to memory of 4808 4864 d147fad9c249b2817d91ea77c88be2d4.exe cmd.exe PID 4808 wrote to memory of 760 4808 cmd.exe test.exe PID 4808 wrote to memory of 760 4808 cmd.exe test.exe PID 4808 wrote to memory of 760 4808 cmd.exe test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d147fad9c249b2817d91ea77c88be2d4.exe"C:\Users\Admin\AppData\Local\Temp\d147fad9c249b2817d91ea77c88be2d4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXAlJeWc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp70BB.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-24-0x00000000751B0000-0x0000000075960000-memory.dmpFilesize
7.7MB
-
memory/760-7-0x0000000005EF0000-0x0000000006494000-memory.dmpFilesize
5.6MB
-
memory/760-8-0x0000000005890000-0x0000000005922000-memory.dmpFilesize
584KB
-
memory/760-6-0x00000000751B0000-0x0000000075960000-memory.dmpFilesize
7.7MB
-
memory/760-9-0x0000000005A70000-0x0000000005A80000-memory.dmpFilesize
64KB
-
memory/760-10-0x0000000005A40000-0x0000000005A4A000-memory.dmpFilesize
40KB
-
memory/760-11-0x0000000005A30000-0x0000000005A38000-memory.dmpFilesize
32KB
-
memory/760-5-0x0000000000E50000-0x0000000000EA8000-memory.dmpFilesize
352KB
-
memory/760-13-0x0000000006540000-0x00000000065DC000-memory.dmpFilesize
624KB
-
memory/760-12-0x0000000005BF0000-0x0000000005C1C000-memory.dmpFilesize
176KB
-
memory/3320-29-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-28-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-51-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-37-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-23-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-22-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-19-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-26-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-33-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-30-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3320-31-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4864-0-0x0000000000400000-0x00000000006F1000-memory.dmpFilesize
2.9MB
-
memory/4864-27-0x0000000000400000-0x00000000006F1000-memory.dmpFilesize
2.9MB
-
memory/4864-25-0x0000000000400000-0x00000000006F1000-memory.dmpFilesize
2.9MB