Analysis
- max time kernel
153s - max time network
115s - platform
windows7_x64 - resource
win7v200430 - submitted
24/06/2020, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe
- Size 236KB
- Sample200624-he8ppf8k12
- SHA256 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330
- MD5 bd363cabf9f24d8fbe49bdc1d828421a
- SHA1 e4c61be3765aacf5936da0cdb3ec389b2afa8cd4
- SHA512 ad981e90310834f5e901f4ef61ce3e586fc447a97e680b9728b6ce6d24e3bba8ae2ecab30591b4becd9830055609dba3f1ed096dee998bcf0f92c9e83d9f1925
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1500 set thread context of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1780 set thread context of 1324 1780 xiqep.exe 34 - Executes dropped EXE 2 IoCs
pid Process 1780 xiqep.exe 1324 xiqep.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe 1324 xiqep.exe - Deletes itself 1 IoCs
pid Process 1592 cmd.exe - Runs net.exe
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\Currentversion\Run xiqep.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\{3FABE710-9830-2656-552A-589E96CA5BB9} = "C:\\Users\\Admin\\AppData\\Roaming\\Anan\\xiqep.exe" xiqep.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 1780 xiqep.exe - Suspicious use of WriteProcessMemory 87 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1644 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 24 PID 1500 wrote to memory of 1644 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 24 PID 1500 wrote to memory of 1644 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 24 PID 1500 wrote to memory of 1644 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 24 PID 1644 wrote to memory of 1568 1644 net.exe 26 PID 1644 wrote to memory of 1568 1644 net.exe 26 PID 1644 wrote to memory of 1568 1644 net.exe 26 PID 1644 wrote to memory of 1568 1644 net.exe 26 PID 1500 wrote to memory of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1500 wrote to memory of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1500 wrote to memory of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1500 wrote to memory of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1500 wrote to memory of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1500 wrote to memory of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1500 wrote to memory of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1500 wrote to memory of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1500 wrote to memory of 1864 1500 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 29 PID 1864 wrote to memory of 1780 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 30 PID 1864 wrote to memory of 1780 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 30 PID 1864 wrote to memory of 1780 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 30 PID 1864 wrote to memory of 1780 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 30 PID 1780 wrote to memory of 608 1780 xiqep.exe 31 PID 1780 wrote to memory of 608 1780 xiqep.exe 31 PID 1780 wrote to memory of 608 1780 xiqep.exe 31 PID 1780 wrote to memory of 608 1780 xiqep.exe 31 PID 608 wrote to memory of 1124 608 net.exe 33 PID 608 wrote to memory of 1124 608 net.exe 33 PID 608 wrote to memory of 1124 608 net.exe 33 PID 608 wrote to memory of 1124 608 net.exe 33 PID 1780 wrote to memory of 1324 1780 xiqep.exe 34 PID 1780 wrote to memory of 1324 1780 xiqep.exe 34 PID 1780 wrote to memory of 1324 1780 xiqep.exe 34 PID 1780 wrote to memory of 1324 1780 xiqep.exe 34 PID 1780 wrote to memory of 1324 1780 xiqep.exe 34 PID 1780 wrote to memory of 1324 1780 xiqep.exe 34 PID 1780 wrote to memory of 1324 1780 xiqep.exe 34 PID 1780 wrote to memory of 1324 1780 xiqep.exe 34 PID 1780 wrote to memory of 1324 1780 xiqep.exe 34 PID 1324 wrote to memory of 1160 1324 xiqep.exe 18 PID 1324 wrote to memory of 1160 1324 xiqep.exe 18 PID 1324 wrote to memory of 1160 1324 xiqep.exe 18 PID 1324 wrote to memory of 1160 1324 xiqep.exe 18 PID 1324 wrote to memory of 1160 1324 xiqep.exe 18 PID 1324 wrote to memory of 1240 1324 xiqep.exe 19 PID 1324 wrote to memory of 1240 1324 xiqep.exe 19 PID 1324 wrote to memory of 1240 1324 xiqep.exe 19 PID 1324 wrote to memory of 1240 1324 xiqep.exe 19 PID 1324 wrote to memory of 1240 1324 xiqep.exe 19 PID 1324 wrote to memory of 1316 1324 xiqep.exe 20 PID 1324 wrote to memory of 1316 1324 xiqep.exe 20 PID 1324 wrote to memory of 1316 1324 xiqep.exe 20 PID 1324 wrote to memory of 1316 1324 xiqep.exe 20 PID 1324 wrote to memory of 1316 1324 xiqep.exe 20 PID 1324 wrote to memory of 1864 1324 xiqep.exe 29 PID 1324 wrote to memory of 1864 1324 xiqep.exe 29 PID 1324 wrote to memory of 1864 1324 xiqep.exe 29 PID 1324 wrote to memory of 1864 1324 xiqep.exe 29 PID 1324 wrote to memory of 1864 1324 xiqep.exe 29 PID 1864 wrote to memory of 1592 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 35 PID 1864 wrote to memory of 1592 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 35 PID 1864 wrote to memory of 1592 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 35 PID 1864 wrote to memory of 1592 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 35 PID 1324 wrote to memory of 1592 1324 xiqep.exe 35 PID 1324 wrote to memory of 1592 1324 xiqep.exe 35 PID 1324 wrote to memory of 1592 1324 xiqep.exe 35 PID 1324 wrote to memory of 1592 1324 xiqep.exe 35 PID 1324 wrote to memory of 1592 1324 xiqep.exe 35 PID 1324 wrote to memory of 2016 1324 xiqep.exe 37 PID 1324 wrote to memory of 2016 1324 xiqep.exe 37 PID 1324 wrote to memory of 2016 1324 xiqep.exe 37 PID 1324 wrote to memory of 2016 1324 xiqep.exe 37 PID 1324 wrote to memory of 2016 1324 xiqep.exe 37 PID 1324 wrote to memory of 1984 1324 xiqep.exe 38 PID 1324 wrote to memory of 1984 1324 xiqep.exe 38 PID 1324 wrote to memory of 1984 1324 xiqep.exe 38 PID 1324 wrote to memory of 1984 1324 xiqep.exe 38 PID 1324 wrote to memory of 1984 1324 xiqep.exe 38 PID 1324 wrote to memory of 1400 1324 xiqep.exe 39 PID 1324 wrote to memory of 1400 1324 xiqep.exe 39 PID 1324 wrote to memory of 1400 1324 xiqep.exe 39 PID 1324 wrote to memory of 1400 1324 xiqep.exe 39 PID 1324 wrote to memory of 1400 1324 xiqep.exe 39 PID 1324 wrote to memory of 1084 1324 xiqep.exe 40 PID 1324 wrote to memory of 1084 1324 xiqep.exe 40 PID 1324 wrote to memory of 1084 1324 xiqep.exe 40 PID 1324 wrote to memory of 1084 1324 xiqep.exe 40 PID 1324 wrote to memory of 1084 1324 xiqep.exe 40 - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe - Loads dropped DLL 2 IoCs
pid Process 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe 1864 233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1160
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1240
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe"C:\Users\Admin\AppData\Local\Temp\233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" " stop sharedaccess"3⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 " stop sharedaccess"4⤵PID:1568
-
-
-
C:\Users\Admin\AppData\Local\Temp\233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe"C:\Users\Admin\AppData\Local\Temp\233e70b105e8fe2f1e9a41b68f380359c8666cea3d9d587ec2ec823cdda2a330.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Roaming\Anan\xiqep.exe"C:\Users\Admin\AppData\Roaming\Anan\xiqep.exe"4⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" " stop sharedaccess"5⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 " stop sharedaccess"6⤵PID:1124
-
-
-
C:\Users\Admin\AppData\Roaming\Anan\xiqep.exe"C:\Users\Admin\AppData\Roaming\Anan\xiqep.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:1324
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp9ea548b6.bat"4⤵
- Deletes itself
PID:1592
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2016
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1984
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1400
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1084