Analysis
-
max time kernel
150s -
max time network
142s -
resource
win7v191014
Task
task1
Sample
a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe
Resource
win10v191014
0 signatures
General
-
Target
a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082
-
Sample
191025-1blc144gba
-
SHA256
a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082
Score
N/A
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exea34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exetaskeng.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exedescription pid process target process PID 1560 wrote to memory of 1048 1560 a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe PID 1048 wrote to memory of 1164 1048 a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe PID 1164 wrote to memory of 804 1164 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe PID 804 wrote to memory of 1408 804 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe svchost.exe PID 2032 wrote to memory of 1964 2032 taskeng.exe a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe PID 1964 wrote to memory of 1796 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe PID 1796 wrote to memory of 1076 1796 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe svchost.exe PID 2032 wrote to memory of 388 2032 taskeng.exe a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe -
Drops file in system dir 12 IoCs
Processes:
a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exedescription ioc pid process File created (read-only) C:\Windows\TEMP\nsf89C7.tmp 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File deleted C:\Windows\Temp\nsf89C7.tmp 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File created (read-only) C:\Windows\TEMP\nsa89F7.tmp 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File deleted C:\Windows\Temp\nsa89F7.tmp 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File created C:\Windows\TEMP\nsa89F7.tmp\System.dll 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File created C:\Windows\TEMP\NP 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File created (read-only) C:\Windows\TEMP\nsv8D6F.tmp 388 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File deleted C:\Windows\Temp\nsv8D6F.tmp 388 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File created (read-only) C:\Windows\TEMP\nsl8D80.tmp 388 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File deleted C:\Windows\Temp\nsl8D80.tmp 388 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File created C:\Windows\TEMP\nsl8D80.tmp\System.dll 388 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe File opened for modification C:\Windows\TEMP\NP 388 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe -
Uses Task Scheduler COM API 1 TTPs 26 IoCs
Processes:
svchost.exesvchost.exedescription ioc pid process Key opened \Registry\Machine\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1408 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1408 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1408 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1408 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID 1408 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1408 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1408 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1408 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1408 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1408 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1408 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1408 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1408 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1408 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1076 svchost.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 1076 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TreatAs 1076 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\Progid 1076 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ProgID\ 1076 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\ 1076 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 1076 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\InprocServer32 1076 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ 1076 svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32\ThreadingModel 1076 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler32 1076 svchost.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocHandler 1076 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeTakeOwnershipPrivilege 1408 svchost.exe -
Processes:
svchost.exesvchost.exedescription ioc pid process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\services\ = "0" 1408 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\services\ = "0" 1076 svchost.exe -
Loads dropped DLL 5 IoCs
Processes:
a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exea34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exepid process 1560 a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe 1048 a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe 1164 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe 388 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exepid process 1560 a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe 1164 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exedescription pid process target process PID 1560 set thread context of 1048 1560 a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe PID 1164 set thread context of 804 1164 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe PID 1964 set thread context of 1796 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe -
Executes dropped EXE 5 IoCs
Processes:
a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exea45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exepid process 1164 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe 804 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe 1964 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe 1796 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe 388 a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe"C:\Users\Admin\AppData\Local\Temp\a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe"1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1560
-
C:\Users\Admin\AppData\Local\Temp\a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe"C:\Users\Admin\AppData\Local\Temp\a34724574b8608308116557503792322d1b7aead2683db636c701462f99f5082.exe"1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1048
-
C:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exeC:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1164
-
C:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exeC:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:804
-
C:\Windows\system32\svchost.exesvchost.exe1⤵
- Uses Task Scheduler COM API
- Suspicious use of AdjustPrivilegeToken
- Windows security bypass
PID:1408
-
C:\Windows\system32\taskeng.exetaskeng.exe {4D2D170B-D071-449D-B167-3B8D77EF3994} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2032
-
C:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exeC:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe1⤵
- Suspicious use of WriteProcessMemory
- Drops file in system dir
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:1964
-
C:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exeC:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1796
-
C:\Windows\system32\svchost.exesvchost.exe1⤵
- Uses Task Scheduler COM API
- Windows security bypass
PID:1076
-
C:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exeC:\Users\Admin\AppData\Roaming\services\a45735675b8708408227667604793433e2b7afae3784eb747d702573g99g6083.exe1⤵
- Drops file in system dir
- Loads dropped DLL
- Executes dropped EXE
PID:388
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1089