Analysis
- max time kernel
136s - max time network
136s - platform
windows10_x64 - resource
win10v200430 - submitted
11/05/2020, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
FC20BCB00BC34F7F1CDB3D436282B4F376B0D4BF8EBADA05F70B9038B602882B.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
FC20BCB00BC34F7F1CDB3D436282B4F376B0D4BF8EBADA05F70B9038B602882B.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target FC20BCB00BC34F7F1CDB3D436282B4F376B0D4BF8EBADA05F70B9038B602882B.exe
- Size 376KB
- Sample200511-tebxtal922
- SHA256 fc20bcb00bc34f7f1cdb3d436282b4f376b0d4bf8ebada05f70b9038b602882b
- MD5 2eb0b5f2d3cd5a377b9308725003df86
- SHA1 4a18af30e45bc5370974bfd76d87e2dcc5f5e543
- SHA512 4bf8ee21439adc4cfe271ba0134f156ce6ee5b60b7444ea9a73d2907e69d2e4af0b2918a3ac95c535eca738fb19ef3aaa77e532d2515891e6965091697b20003
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2916 FC20BCB00BC34F7F1CDB3D436282B4F376B0D4BF8EBADA05F70B9038B602882B.exe Token: SeDebugPrivilege 3636 UpdateService.exe Token: SeDebugPrivilege 64 UpdateService.exe Token: SeDebugPrivilege 1144 UpdateService.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2916 wrote to memory of 3636 2916 FC20BCB00BC34F7F1CDB3D436282B4F376B0D4BF8EBADA05F70B9038B602882B.exe 66 PID 2916 wrote to memory of 3636 2916 FC20BCB00BC34F7F1CDB3D436282B4F376B0D4BF8EBADA05F70B9038B602882B.exe 66 PID 3636 wrote to memory of 420 3636 UpdateService.exe 67 PID 3636 wrote to memory of 420 3636 UpdateService.exe 67 PID 3636 wrote to memory of 652 3636 UpdateService.exe 69 PID 3636 wrote to memory of 652 3636 UpdateService.exe 69 PID 3636 wrote to memory of 996 3636 UpdateService.exe 71 PID 3636 wrote to memory of 996 3636 UpdateService.exe 71 PID 64 wrote to memory of 1144 64 UpdateService.exe 74 PID 64 wrote to memory of 1144 64 UpdateService.exe 74 PID 1144 wrote to memory of 1368 1144 UpdateService.exe 75 PID 1144 wrote to memory of 1368 1144 UpdateService.exe 75 PID 1144 wrote to memory of 1572 1144 UpdateService.exe 77 PID 1144 wrote to memory of 1572 1144 UpdateService.exe 77 PID 1144 wrote to memory of 2184 1144 UpdateService.exe 80 PID 1144 wrote to memory of 2184 1144 UpdateService.exe 80 PID 2184 wrote to memory of 2712 2184 csc.exe 82 PID 2184 wrote to memory of 2712 2184 csc.exe 82 PID 1144 wrote to memory of 2888 1144 UpdateService.exe 83 PID 1144 wrote to memory of 2888 1144 UpdateService.exe 83 PID 1144 wrote to memory of 3828 1144 UpdateService.exe 85 PID 1144 wrote to memory of 3828 1144 UpdateService.exe 85 PID 3836 wrote to memory of 3912 3836 net.exe 89 PID 3836 wrote to memory of 3912 3836 net.exe 89 PID 3872 wrote to memory of 3844 3872 net.exe 90 PID 3872 wrote to memory of 3844 3872 net.exe 90 - Executes dropped EXE 3 IoCs
pid Process 3636 UpdateService.exe 64 UpdateService.exe 1144 UpdateService.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\UpdateService.exe.log UpdateService.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections UpdateService.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1144 UpdateService.exe 1144 UpdateService.exe 1144 UpdateService.exe - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 652 schtasks.exe 1572 schtasks.exe - CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
- Checks for installed software on the system 1 TTPs 63 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 75.0 (x64 en-US)\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180660}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName UpdateService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall UpdateService.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall UpdateService.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F86418066F0}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12578975-C765-4BDF-8DDC-3284BC0E855F}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService\DisplayName UpdateService.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName UpdateService.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName UpdateService.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}\DisplayName UpdateService.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FC20BCB00BC34F7F1CDB3D436282B4F376B0D4BF8EBADA05F70B9038B602882B.exe"C:\Users\Admin\AppData\Local\Temp\FC20BCB00BC34F7F1CDB3D436282B4F376B0D4BF8EBADA05F70B9038B602882B.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\ProgramData\UpdateService\UpdateService.exe"C:\ProgramData\UpdateService\UpdateService.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3636 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /TN "UpdateService" /F3⤵PID:420
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU SYSTEM /SC ONSTART /TN "UpdateService" /TR "\"C:\ProgramData\UpdateService\UpdateService.exe\" -t"3⤵
- Creates scheduled task(s)
PID:652
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Run /TN "UpdateService"3⤵PID:996
-
-
-
C:\ProgramData\UpdateService\UpdateService.exeC:\ProgramData\UpdateService\UpdateService.exe -t1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Drops file in System32 directory
PID:64 -
C:\ProgramData\UpdateService\UpdateService.exe"C:\ProgramData\UpdateService\UpdateService.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Checks for installed software on the system
PID:1144 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /TN "UpdateService" /F3⤵PID:1368
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU SYSTEM /SC ONSTART /TN "UpdateService" /TR "\"C:\ProgramData\UpdateService\UpdateService.exe\" -t"3⤵
- Creates scheduled task(s)
PID:1572
-
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\8y_kch4o.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESB3CB.tmp" "c:\Windows\Temp\CSCB3CA.tmp"4⤵PID:2712
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c net group "domain admins" /domain3⤵PID:2888
-
C:\Windows\system32\net.exenet group "domain admins" /domain4⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "domain admins" /domain5⤵PID:3844
-
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c net group "domain users" /domain3⤵PID:3828
-
C:\Windows\system32\net.exenet group "domain users" /domain4⤵
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "domain users" /domain5⤵PID:3912
-
-
-
-