Analysis
- max time kernel
150s - max time network
157s - platform
windows7_x64 - resource
win7v200430 - submitted
25/06/2020, 16:51
Static task
static1
Behavioral task
behavioral1
Sample
eER8H4h9QVFZRP1.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
eER8H4h9QVFZRP1.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target eER8H4h9QVFZRP1.exe
- Size 395KB
- Sample200625-5jtpc2ja62
- SHA256 2e96f7a6b4dd1d5251af4962a9028aac90c2ceb282495018c2d879ebf583f9ea
- MD5 1bd39d112cfa62ded925b77652507e48
- SHA1 a4c5a93a7304b61745a0e2268634c8feb5c09022
- SHA512 bc08d50c46a7bf138f8233b75c9477ba244c8d6abaa86bec9b8da47577ce37bec05aca574291bed5350fe78cb7fc485b1890b9a3ee96117874bdf5d05f4835d3
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1356 wrote to memory of 1804 1356 eER8H4h9QVFZRP1.exe 26 PID 1356 wrote to memory of 1804 1356 eER8H4h9QVFZRP1.exe 26 PID 1356 wrote to memory of 1804 1356 eER8H4h9QVFZRP1.exe 26 PID 1356 wrote to memory of 1804 1356 eER8H4h9QVFZRP1.exe 26 PID 1356 wrote to memory of 1804 1356 eER8H4h9QVFZRP1.exe 26 PID 1356 wrote to memory of 1804 1356 eER8H4h9QVFZRP1.exe 26 PID 1356 wrote to memory of 1804 1356 eER8H4h9QVFZRP1.exe 26 PID 1324 wrote to memory of 1824 1324 Explorer.EXE 27 PID 1324 wrote to memory of 1824 1324 Explorer.EXE 27 PID 1324 wrote to memory of 1824 1324 Explorer.EXE 27 PID 1324 wrote to memory of 1824 1324 Explorer.EXE 27 PID 1824 wrote to memory of 1776 1824 systray.exe 28 PID 1824 wrote to memory of 1776 1824 systray.exe 28 PID 1824 wrote to memory of 1776 1824 systray.exe 28 PID 1824 wrote to memory of 1776 1824 systray.exe 28 - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1356 set thread context of 1804 1356 eER8H4h9QVFZRP1.exe 26 PID 1804 set thread context of 1324 1804 eER8H4h9QVFZRP1.exe 20 PID 1824 set thread context of 1324 1824 systray.exe 20 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1804 eER8H4h9QVFZRP1.exe 1804 eER8H4h9QVFZRP1.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe 1824 systray.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1804 eER8H4h9QVFZRP1.exe Token: SeDebugPrivilege 1824 systray.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE - Deletes itself 1 IoCs
pid Process 1776 cmd.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1804 eER8H4h9QVFZRP1.exe 1804 eER8H4h9QVFZRP1.exe 1804 eER8H4h9QVFZRP1.exe 1824 systray.exe 1824 systray.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\eER8H4h9QVFZRP1.exe"C:\Users\Admin\AppData\Local\Temp\eER8H4h9QVFZRP1.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\eER8H4h9QVFZRP1.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1804
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1824 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\eER8H4h9QVFZRP1.exe"3⤵
- Deletes itself
PID:1776
-
-