Analysis
- max time kernel
149s - max time network
135s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe
- Size 204KB
- Sample200624-mbenzd5h8a
- SHA256 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06
- MD5 36643dace9fdd4e729632b33204f6499
- SHA1 12a0e337894f802116e31c47fd0dbfdb81bd3217
- SHA512 7a282cc402c9d922c9483a11abdb44fec3a2bc61a6ec62be3a19d8cf291bc70d701089d841c87821f0bf271055f9665e9d170cb834a6e59e92d5450a4f5279ba
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\c25cdf91e7e16aa9b34777d0cfae03fd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dwam.exe\" .." dwam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c25cdf91e7e16aa9b34777d0cfae03fd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dwam.exe\" .." dwam.exe - Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c25cdf91e7e16aa9b34777d0cfae03fd.exe dwam.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c25cdf91e7e16aa9b34777d0cfae03fd.exe dwam.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2808 wrote to memory of 3692 2808 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe 67 PID 2808 wrote to memory of 3692 2808 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe 67 PID 2808 wrote to memory of 3692 2808 3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe 67 PID 3692 wrote to memory of 3816 3692 server.exe 68 PID 3692 wrote to memory of 3816 3692 server.exe 68 PID 3692 wrote to memory of 3816 3692 server.exe 68 PID 3816 wrote to memory of 3884 3816 dwam.exe 69 PID 3816 wrote to memory of 3884 3816 dwam.exe 69 PID 3816 wrote to memory of 3884 3816 dwam.exe 69 - Executes dropped EXE 2 IoCs
pid Process 3692 server.exe 3816 dwam.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe Token: 33 3816 dwam.exe Token: SeIncBasePriorityPrivilege 3816 dwam.exe - Modifies Windows Firewall 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe"C:\Users\Admin\AppData\Local\Temp\3077055cce808941a7f085363a6b4fbed04a0e9ca6f2af10a4e7afcf69326b06.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\dwam.exe"C:\Users\Admin\AppData\Local\Temp\dwam.exe"3⤵
- Adds Run entry to start application
- Drops startup file
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3816 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dwam.exe" "dwam.exe" ENABLE4⤵PID:3884
-
-
-