Analysis
- max time kernel
150s - max time network
53s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target 10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22.exe
- Size 129KB
- Sample200624-te6vcj4sy2
- SHA256 10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22
- MD5 dcc61969726dcdb49a869cbbbd03a316
- SHA1 928492c4763b427761f9bcaeec51ba533be8d32e
- SHA512 7cf24ff07278076ac71ef7c2ae010a3ddaa738d10b50e811bc4bfe29686278e3720740f0533c3795149cc60fad8e4cc9b7921c81a6d7ce878760b1707ba59fd9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 640 wrote to memory of 2100 640 10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22.exe 68 PID 640 wrote to memory of 2100 640 10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22.exe 68 PID 640 wrote to memory of 2100 640 10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22.exe 68 PID 2100 wrote to memory of 3964 2100 server.exe 73 PID 2100 wrote to memory of 3964 2100 server.exe 73 PID 2100 wrote to memory of 3964 2100 server.exe 73 - Executes dropped EXE 1 IoCs
pid Process 2100 server.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe Token: 33 2100 server.exe Token: SeIncBasePriorityPrivilege 2100 server.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1579703444a5d397a491c60a5505be31.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1579703444a5d397a491c60a5505be31.exe server.exe - Modifies Windows Firewall 1 TTPs
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\1579703444a5d397a491c60a5505be31 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1579703444a5d397a491c60a5505be31 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22.exe"C:\Users\Admin\AppData\Local\Temp\10013ab78be09ad756cc64005e2b7b65cf30257d2f01afc1212a6a7c03c4fa22.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Drops startup file
- Adds Run entry to start application
PID:2100 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵PID:3964
-
-