190c75b9994d5f5bf75f227a4de53392f834699f1e854eb9ac3728e029aea849

General

Target

81b032900fcb4e5cd13b226d13453cf4.exe
Size

4.9MB
MD5

81b032900fcb4e5cd13b226d13453cf4
SHA1

413133e303b5552958949c4bdf481f9c9c5c3324
SHA256

190c75b9994d5f5bf75f227a4de53392f834699f1e854eb9ac3728e029aea849
SHA512

cdbb1968cfa03053b82eed2bc2226bf58298128397971b2c7ec5141c5c873a19f36b0a36f2ae978bc621464d174a61c94e287f601caaa677fea2ef35a96582e6
SSDEEP

98304:3KvQ/bZR3d1y9eoPQihNcOTgOSFJ92wJV79FeVzjraGfIBvhVkhC2YtTV:3KvQVR3fyIooaNr8OS1JGvra2Yv

Score

9^/10

rezer0

Malware Config

Signatures

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2092-4-0x0000000000CF0000-0x0000000000D1E000-memory.dmp	rezer0

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2796 schtasks.exe

pid	process
2796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

81b032900fcb4e5cd13b226d13453cf4.exe

pid	process
2092	81b032900fcb4e5cd13b226d13453cf4.exe
2092	81b032900fcb4e5cd13b226d13453cf4.exe
2092	81b032900fcb4e5cd13b226d13453cf4.exe
2092	81b032900fcb4e5cd13b226d13453cf4.exe
2092	81b032900fcb4e5cd13b226d13453cf4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

81b032900fcb4e5cd13b226d13453cf4.exe

description pid process

Token: SeDebugPrivilege 2092 81b032900fcb4e5cd13b226d13453cf4.exe

description	pid	process
Token: SeDebugPrivilege	2092	81b032900fcb4e5cd13b226d13453cf4.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

81b032900fcb4e5cd13b226d13453cf4.exe

C:\Users\Admin\AppData\Local\Temp\81b032900fcb4e5cd13b226d13453cf4.exe
"C:\Users\Admin\AppData\Local\Temp\81b032900fcb4e5cd13b226d13453cf4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KSridAySHa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6049.tmp"
2⤵
- Creates scheduled task(s)
PID:2796

C:\Users\Admin\AppData\Local\Temp\81b032900fcb4e5cd13b226d13453cf4.exe
"{path}"
2⤵
PID:2680

C:\Users\Admin\AppData\Local\Temp\81b032900fcb4e5cd13b226d13453cf4.exe
"{path}"
2⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\81b032900fcb4e5cd13b226d13453cf4.exe
"{path}"
2⤵
PID:2660

C:\Users\Admin\AppData\Local\Temp\81b032900fcb4e5cd13b226d13453cf4.exe
"{path}"
2⤵
PID:2612

C:\Users\Admin\AppData\Local\Temp\81b032900fcb4e5cd13b226d13453cf4.exe
"{path}"
2⤵
PID:2580

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6049.tmp
Filesize
1KB

MD5
24d9f7b7ac60a437409e9089156701f7

SHA1
2c2317602c6462d00ac6b23578dfdc7fd7001c40

SHA256
308011a8401f4cd1824d9aa22a459f9de04dc1c1defa648cbb364c86448ccd7a

SHA512
edd1438383b7ed824d09966c26fdbabca8d87e5c26d34be2330ed017387ac250c7abe4059e0ab65a0b15288c6b97d58f3173a46e73de815a9224280218dafcd6

Download Submit
memory/2092-0-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2092-1-0x0000000000140000-0x0000000000632000-memory.dmp

Filesize
4.9MB

Download
memory/2092-2-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2092-3-0x00000000007E0000-0x00000000007E8000-memory.dmp

Filesize
32KB

Download
memory/2092-4-0x0000000000CF0000-0x0000000000D1E000-memory.dmp

Filesize
184KB

Download
memory/2092-10-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2092 wrote to memory of 2796	2092	81b032900fcb4e5cd13b226d13453cf4.exe	schtasks.exe
PID 2092 wrote to memory of 2796	2092	81b032900fcb4e5cd13b226d13453cf4.exe	schtasks.exe
PID 2092 wrote to memory of 2796	2092	81b032900fcb4e5cd13b226d13453cf4.exe	schtasks.exe
PID 2092 wrote to memory of 2796	2092	81b032900fcb4e5cd13b226d13453cf4.exe	schtasks.exe
PID 2092 wrote to memory of 2680	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2680	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2680	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2680	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2712	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2712	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2712	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2712	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2660	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2660	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2660	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2660	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2612	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2612	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2612	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2612	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2580	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2580	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2580	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe
PID 2092 wrote to memory of 2580	2092	81b032900fcb4e5cd13b226d13453cf4.exe	81b032900fcb4e5cd13b226d13453cf4.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads