5a9e3280eb6db0cfbd5a5fd70a4c58e35e397c29f7cda8306c681151030f4352

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d.exe
Size

1.1MB
MD5

3667fcde90db97a8b6007a06ff7b49da
SHA1

d21c5a703d711950b1e052a7a1bf70e2e14fdf19
SHA256

6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d
SHA512

9c6dce629f70fc3eeda4dbd171aef01b53f1b4a087f56c09f67e661a775c0a0c4b84313f65d14ec90dfbbc62e09fd85f158d2e9d1fd43242a11059d6195232ef
SSDEEP

24576:bI1HQFplGzTSqzKMquOYrDbl015VCTaKUxcFk2CnfsgvPQnyv/cHw:c1HQFplGpKlubr/EfsbRknUgvPQnyGw

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3676	vpn2.exe

Loads dropped DLL 1 IoCs

pid	Process
804	6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	iplogger.org
24	iplogger.org

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Romblbee\vpn2.exe	6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
656	3676	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpn2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3676	vpn2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 3676	804	6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d.exe	83
PID 804 wrote to memory of 3676	804	6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d.exe	83
PID 804 wrote to memory of 3676	804	6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d.exe	83

C:\Users\Admin\AppData\Local\Temp\6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d.exe
"C:\Users\Admin\AppData\Local\Temp\6e80e005df38336538ccb8d85ab2bc29cfa761243a4715a28c437c501170372d.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:804
- C:\Program Files (x86)\Romblbee\vpn2.exe
  "C:\Program Files (x86)\Romblbee\vpn2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1700
    3⤵
    - Program crash
    PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3676 -ip 3676
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Romblbee\vpn2.exe

Filesize
1.3MB

MD5
fedc12761c161021b24e55df8634a0d5

SHA1
750bcf790aa9d2981d90a3ede63ca7856ae12eeb

SHA256
c18292ba5f1e7081f1afaf5e62e63823ffc1673ea59a9d62cd4ff1b8ec7e1903

SHA512
838333cfe967e99b8a23499a13123ddedfbbd369b968524cbc7cf442444350b985ceddf2cfa79513923f06f409759ae022d670b71b12611fae331fb40909fc7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
memory/3676-9-0x000000007409E000-0x000000007409F000-memory.dmp

Filesize
4KB

Download
memory/3676-10-0x0000000000F00000-0x000000000105C000-memory.dmp

Filesize
1.4MB

Download
memory/3676-11-0x00000000059F0000-0x0000000005B26000-memory.dmp

Filesize
1.2MB

Download
memory/3676-12-0x0000000074090000-0x0000000074840000-memory.dmp

Filesize
7.7MB

Download
memory/3676-13-0x000000007409E000-0x000000007409F000-memory.dmp

Filesize
4KB

Download
memory/3676-14-0x0000000074090000-0x0000000074840000-memory.dmp

Filesize
7.7MB

Download
memory/3676-15-0x0000000005B30000-0x0000000005BCE000-memory.dmp

Filesize
632KB

Download
memory/3676-16-0x0000000074090000-0x0000000074840000-memory.dmp

Filesize
7.7MB

Download