f1378f1135c7b053fa14881acdb9e206c032dd8379bc31d9ce05cfa25d49bd9e

General

Target

8078089e62c9e70865bf9edad8efb851.exe
Size

1.4MB
MD5

8078089e62c9e70865bf9edad8efb851
SHA1

bcfc7afe63f4de2b1e15bacb8ad90b53bf8defc1
SHA256

f1378f1135c7b053fa14881acdb9e206c032dd8379bc31d9ce05cfa25d49bd9e
SHA512

1fd2900d72f43523b21447959b48021f295290a78eaeca42f6f2d656b3b8ba077c2020706a50d81f8fabecae5eb208ac688d4ab72f79d03e0aab023d3c35dc96
SSDEEP

24576:X6yJMY9UFoRDhkeYM1jJR97zUbia9JVe0hs5WfBiERJchVML1bT6Eg:qY9UORVOM1jJHzaiape0hsABFRJch6Lk

Score

9^/10

rezer0 upx

Malware Config

Signatures

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/4780-12-0x0000000005250000-0x000000000527C000-memory.dmp	rezer0

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

test.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation test.exe
Executes dropped EXE 1 IoCs

Processes:

test.exe

pid process

4780 test.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	test.exe

pid	process
4780	test.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1512-0-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral2/memory/1512-21-0x0000000000400000-0x00000000006F1000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3896 schtasks.exe
Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

test.exe

pid process

4780 test.exe
4780 test.exe
4780 test.exe
4780 test.exe
4780 test.exe
4780 test.exe
4780 test.exe
4780 test.exe
4780 test.exe
4780 test.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

test.exe

description pid process

Token: SeDebugPrivilege 4780 test.exe

pid	process
3896	schtasks.exe

pid	process
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe
4780	test.exe

description	pid	process
Token: SeDebugPrivilege	4780	test.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

8078089e62c9e70865bf9edad8efb851.execmd.exetest.exe

description	pid	process	target process
PID 1512 wrote to memory of 2576	1512	8078089e62c9e70865bf9edad8efb851.exe	cmd.exe
PID 1512 wrote to memory of 2576	1512	8078089e62c9e70865bf9edad8efb851.exe	cmd.exe
PID 1512 wrote to memory of 2576	1512	8078089e62c9e70865bf9edad8efb851.exe	cmd.exe
PID 2576 wrote to memory of 4780	2576	cmd.exe	test.exe
PID 2576 wrote to memory of 4780	2576	cmd.exe	test.exe
PID 2576 wrote to memory of 4780	2576	cmd.exe	test.exe
PID 4780 wrote to memory of 3896	4780	test.exe	schtasks.exe
PID 4780 wrote to memory of 3896	4780	test.exe	schtasks.exe
PID 4780 wrote to memory of 3896	4780	test.exe	schtasks.exe
PID 4780 wrote to memory of 1584	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 1584	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 1584	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 688	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 688	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 688	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 4728	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 4728	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 4728	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 1480	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 1480	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 1480	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 368	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 368	4780	test.exe	vbc.exe
PID 4780 wrote to memory of 368	4780	test.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\8078089e62c9e70865bf9edad8efb851.exe
"C:\Users\Admin\AppData\Local\Temp\8078089e62c9e70865bf9edad8efb851.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c test.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Users\Admin\AppData\Local\Temp\test.exe
test.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXAlJeWc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp72DE.tmp"
4⤵
- Creates scheduled task(s)
PID:3896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:1584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:4728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:1480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:368

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
277KB

MD5
939fefac7c384ef123eef56300847ce2

SHA1
34d279b717f1a24728890f6ca1bbcf708ac54481

SHA256
70d7a20165e78e8e48d32cc9304d0239adea52fff3cf5d3283b9df94484d2208

SHA512
26759ed3535854005aadb48dba4b1ad0009d31a1efab6a4cab37f6c3b18d8cee5afdbcdbd3d9cbd9f12a87d2c9429a8b0c84c888b42823d311d1b11e78704243

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
175KB

MD5
5e6c80130eed7af7d65d07795c10261b

SHA1
b78154ed384aa29d15f3145d508573bd2529537e

SHA256
d0c6677897d4a62a84794beb9047f492c36bbeaff3488735346bdc451bb705ea

SHA512
bf0282f841348783e07b66465661871d0901f0fccd9cb22cceefb0e2409ac11d0e565bb83f9d80dcee66ee2d311f6d099a856352f16b816193ff5a9f632027bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp72DE.tmp
Filesize
1KB

MD5
2312fee8efad283cbb21c632a6b6ca9d

SHA1
ba82deaee09f5047757f541f88b9df5bbcd0e6dd

SHA256
373b29b4c2d651f5a9d6842862b00bb9fef31756f758b5e8f7f90bb69faf1ee9

SHA512
e3f0e559a0bf258b88b3e80003831ed7abba7d58f06cea287ee428b3d898a7469592ebf4897f5861a452e60734bfdedd66e144ee2482d94f02cf8531c046a4c2

Download Submit
C:\Users\Admin\AppData\Roaming\vXAlJeWc.exe
Filesize
330KB

MD5
261aa73f93c90dcec0c36a51cb9b5dee

SHA1
b0c41e06cd2ded81706820423db40bf8fea2c957

SHA256
ae160b749914bd56aecbcf43d56a59bde2069a145682b2911fe50c6adabe1b54

SHA512
7b90335b4a7db7b5056f6d60db642754038dc544bd2c1f82e68b1f8e339bf70227f0c08d157b4ca1004448fab7d109f0239196f242d0edeab978de9025a3c0ed

Download Submit
memory/1512-21-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/1512-0-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/4780-5-0x00000000005D0000-0x0000000000628000-memory.dmp

Filesize
352KB

Download
memory/4780-9-0x00000000050D0000-0x00000000050E0000-memory.dmp

Filesize
64KB

Download
memory/4780-10-0x0000000005080000-0x000000000508A000-memory.dmp

Filesize
40KB

Download
memory/4780-11-0x0000000004ED0000-0x0000000004ED8000-memory.dmp

Filesize
32KB

Download
memory/4780-13-0x0000000005AF0000-0x0000000005B8C000-memory.dmp

Filesize
624KB

Download
memory/4780-12-0x0000000005250000-0x000000000527C000-memory.dmp

Filesize
176KB

Download
memory/4780-7-0x00000000054A0000-0x0000000005A44000-memory.dmp

Filesize
5.6MB

Download
memory/4780-8-0x0000000004EF0000-0x0000000004F82000-memory.dmp

Filesize
584KB

Download
memory/4780-20-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/4780-6-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads