Analysis
- max time kernel
148s - max time network
142s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
regasm(4).exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
regasm(4).exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target regasm(4).exe
- Size 367KB
- Sample200624-lep93t7e66
- SHA256 4adb6a21c1056dafc19fe22df99b061d94e25e258aa4ff3c35fb8cc65faa2c17
- MD5 ea931672906ed9a7913a88440b807dc3
- SHA1 aff085ccaad6eab712d5f2c51f9a03b1fe70008b
- SHA512 d61c081ba0e43c10d79206212936c8e3108b80d5d1e056e28dfcc7517cab7686268f15dde6f15770e39f6f5f4a5004ebf93267139e441bda3a8c072c38a89bce
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1852 cmd.exe Token: SeDebugPrivilege 2888 cmmon32.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1852 set thread context of 3024 1852 cmd.exe 56 PID 2888 set thread context of 3024 2888 cmmon32.exe 56 - Loads dropped DLL 3 IoCs
pid Process 1600 regasm(4).exe 1600 regasm(4).exe 3712 rundll32.exe - Suspicious use of WriteProcessMemory 92 IoCs
description pid Process procid_target PID 1600 wrote to memory of 3712 1600 regasm(4).exe 68 PID 1600 wrote to memory of 3712 1600 regasm(4).exe 68 PID 1600 wrote to memory of 3712 1600 regasm(4).exe 68 PID 3712 wrote to memory of 1816 3712 rundll32.exe 69 PID 3712 wrote to memory of 1816 3712 rundll32.exe 69 PID 3712 wrote to memory of 1816 3712 rundll32.exe 69 PID 3712 wrote to memory of 1816 3712 rundll32.exe 69 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3712 wrote to memory of 1852 3712 rundll32.exe 70 PID 3024 wrote to memory of 2888 3024 Explorer.EXE 75 PID 3024 wrote to memory of 2888 3024 Explorer.EXE 75 PID 3024 wrote to memory of 2888 3024 Explorer.EXE 75 PID 2888 wrote to memory of 3872 2888 cmmon32.exe 76 PID 2888 wrote to memory of 3872 2888 cmmon32.exe 76 PID 2888 wrote to memory of 3872 2888 cmmon32.exe 76 - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 3712 rundll32.exe 3712 rundll32.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe 2888 cmmon32.exe - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3712 rundll32.exe 3712 rundll32.exe 1852 cmd.exe 1852 cmd.exe 1852 cmd.exe 2888 cmmon32.exe 2888 cmmon32.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\regasm(4).exe"C:\Users\Admin\AppData\Local\Temp\regasm(4).exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe LarContrafagotto,Pretor3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1816
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1852
-
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2888 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:3872
-
-