Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 05:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
106b947aa2e8101bff6e3ff0f82bfe95.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
106b947aa2e8101bff6e3ff0f82bfe95.exe
-
Size
3.2MB
-
MD5
106b947aa2e8101bff6e3ff0f82bfe95
-
SHA1
78a381408947f252bcbe170a4223c8a5a64fc11f
-
SHA256
88689636f4b2287701b63f42c12e7e2387bf4c3ecc45eeb8a61ea707126bad9b
-
SHA512
da8e58f307b7dfba78a96e1af5a4c9df79040f7d5a1181a08926bd32ff6d782375636882703d4eb6d194876c9aafd8394cde129ba401d66c5079393d84433693
-
SSDEEP
49152:yNUPRS5YfeBi35enfGiSpQQ17dWRsnVQLKaCTpdNu:d/+I7mwFTpf
Malware Config
Extracted
Family
rustybuer
C2
https://cerionetya.com/
Signatures
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: secinit.exe File opened (read-only) \??\L: secinit.exe File opened (read-only) \??\I: secinit.exe File opened (read-only) \??\h: secinit.exe File opened (read-only) \??\P: secinit.exe File opened (read-only) \??\R: secinit.exe File opened (read-only) \??\u: secinit.exe File opened (read-only) \??\e: secinit.exe File opened (read-only) \??\l: secinit.exe File opened (read-only) \??\N: secinit.exe File opened (read-only) \??\O: secinit.exe File opened (read-only) \??\p: secinit.exe File opened (read-only) \??\S: secinit.exe File opened (read-only) \??\T: secinit.exe File opened (read-only) \??\K: secinit.exe File opened (read-only) \??\v: secinit.exe File opened (read-only) \??\o: secinit.exe File opened (read-only) \??\F: secinit.exe File opened (read-only) \??\k: secinit.exe File opened (read-only) \??\q: secinit.exe File opened (read-only) \??\U: secinit.exe File opened (read-only) \??\X: secinit.exe File opened (read-only) \??\Y: secinit.exe File opened (read-only) \??\z: secinit.exe File opened (read-only) \??\a: secinit.exe File opened (read-only) \??\g: secinit.exe File opened (read-only) \??\G: secinit.exe File opened (read-only) \??\r: secinit.exe File opened (read-only) \??\W: secinit.exe File opened (read-only) \??\Z: secinit.exe File opened (read-only) \??\E: secinit.exe File opened (read-only) \??\b: secinit.exe File opened (read-only) \??\B: secinit.exe File opened (read-only) \??\D: secinit.exe File opened (read-only) \??\H: secinit.exe File opened (read-only) \??\i: secinit.exe File opened (read-only) \??\M: secinit.exe File opened (read-only) \??\s: secinit.exe File opened (read-only) \??\A: secinit.exe File opened (read-only) \??\V: secinit.exe File opened (read-only) \??\m: secinit.exe File opened (read-only) \??\n: secinit.exe File opened (read-only) \??\Q: secinit.exe File opened (read-only) \??\t: secinit.exe File opened (read-only) \??\w: secinit.exe File opened (read-only) \??\x: secinit.exe File opened (read-only) \??\y: secinit.exe File opened (read-only) \??\j: secinit.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1368 set thread context of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3204 secinit.exe 3204 secinit.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1368 wrote to memory of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99 PID 1368 wrote to memory of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99 PID 1368 wrote to memory of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99 PID 1368 wrote to memory of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99 PID 1368 wrote to memory of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99 PID 1368 wrote to memory of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99 PID 1368 wrote to memory of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99 PID 1368 wrote to memory of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99 PID 1368 wrote to memory of 3204 1368 106b947aa2e8101bff6e3ff0f82bfe95.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\106b947aa2e8101bff6e3ff0f82bfe95.exe"C:\Users\Admin\AppData\Local\Temp\106b947aa2e8101bff6e3ff0f82bfe95.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\secinit.exe"C:\Windows\System32\secinit.exe"2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:3204
-