Analysis
- max time kernel
146s - max time network
149s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe
- Size 492KB
- Sample200624-28nmvr4786
- SHA256 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054
- MD5 4e0ae3808fb36e14a65d9ee253a3a082
- SHA1 b251a10dbb740c1ed8f536f0a990cae576b63132
- SHA512 88fef994505d38df0c494b4cf23b704d17dd7c7ad817b83292dbf5d44ea61624413bf6a882aa514a2a03d378f3bd543fcf511068b763f92d9f5a03e5b27f71b8
- MD5 SHA1 SHA512
Malware Config
Signatures
- Drops file in Program Files directory 10 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\kfo1 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe File created C:\Program Files (x86)\kfo1\e-commerce-icon-icon.ico2.ico 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe File opened for modification C:\Program Files (x86)\kfo1\e-commerce-icon-icon.ico2.ico 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe File created C:\Program Files (x86)\kfo1\Test_1.exe 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe File created C:\Program Files (x86)\kfo1\kfo1.exe 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe File created C:\Program Files (x86)\kfo1\__tmp_rar_sfx_access_check_127562 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe File opened for modification C:\Program Files (x86)\kfo1\Test_1.exe 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe File opened for modification C:\Program Files (x86)\kfo1\kfo1.exe 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe File created C:\Program Files (x86)\kfo1\icon.ico 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe File opened for modification C:\Program Files (x86)\kfo1\icon.ico 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe - Modifies Windows Firewall 1 TTPs
- Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1016 1916 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe 68 PID 1916 wrote to memory of 1016 1916 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe 68 PID 1916 wrote to memory of 1016 1916 689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe 68 PID 1016 wrote to memory of 3556 1016 kfo1.exe 73 PID 1016 wrote to memory of 3556 1016 kfo1.exe 73 PID 1016 wrote to memory of 3556 1016 kfo1.exe 73 PID 3556 wrote to memory of 3888 3556 server.exe 75 PID 3556 wrote to memory of 3888 3556 server.exe 75 PID 3556 wrote to memory of 3888 3556 server.exe 75 - Executes dropped EXE 2 IoCs
pid Process 1016 kfo1.exe 3556 server.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe Token: 33 3556 server.exe Token: SeIncBasePriorityPrivilege 3556 server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe"C:\Users\Admin\AppData\Local\Temp\689290a8b842a0fd09f5ce00654d64d70d0be3e19e2ca60d5dd3d199d3e09054.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\kfo1\kfo1.exe"C:\Program Files (x86)\kfo1\kfo1.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3556 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE4⤵PID:3888
-
-
-