Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7 -
submitted
26/06/2020, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
JEsNEuI.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
JEsNEuI.dll
-
Size
356KB
-
MD5
9eea7a0571baf33fa6877e8f8ebb3ad7
-
SHA1
9a7738f3f73d78d9fe18ba5401081d27f4222c8d
-
SHA256
121d7fc3a0a43a6ef4b73f564175b92727281155b221ff6f34c00d73438b679e
-
SHA512
90b6440f8c0fd2946eb5e47882aaf6b608fc900e9684daf4da74579d8863e83d26be7d27e2e074a98fdf631f2e9d44bc3e79a619ef88db009ade73516afa3e94
Score
10/10
Malware Config
Signatures
-
Runs net.exe
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 1472 net.exe 520 net.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 1804 msiexec.exe Token: SeSecurityPrivilege 1804 msiexec.exe -
Blacklisted process makes network request 10 IoCs
flow pid Process 8 1804 msiexec.exe 9 1804 msiexec.exe 10 1804 msiexec.exe 11 1804 msiexec.exe 12 1804 msiexec.exe 13 1804 msiexec.exe 14 1804 msiexec.exe 15 1804 msiexec.exe 16 1804 msiexec.exe 17 1804 msiexec.exe -
Modifies service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs ipconfig.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas ipconfig.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1316 wrote to memory of 1276 1316 rundll32.exe 24 PID 1316 wrote to memory of 1276 1316 rundll32.exe 24 PID 1316 wrote to memory of 1276 1316 rundll32.exe 24 PID 1316 wrote to memory of 1276 1316 rundll32.exe 24 PID 1316 wrote to memory of 1276 1316 rundll32.exe 24 PID 1316 wrote to memory of 1276 1316 rundll32.exe 24 PID 1316 wrote to memory of 1276 1316 rundll32.exe 24 PID 1276 wrote to memory of 1804 1276 rundll32.exe 27 PID 1276 wrote to memory of 1804 1276 rundll32.exe 27 PID 1276 wrote to memory of 1804 1276 rundll32.exe 27 PID 1276 wrote to memory of 1804 1276 rundll32.exe 27 PID 1276 wrote to memory of 1804 1276 rundll32.exe 27 PID 1276 wrote to memory of 1804 1276 rundll32.exe 27 PID 1276 wrote to memory of 1804 1276 rundll32.exe 27 PID 1276 wrote to memory of 1804 1276 rundll32.exe 27 PID 1276 wrote to memory of 1804 1276 rundll32.exe 27 PID 1804 wrote to memory of 1920 1804 msiexec.exe 30 PID 1804 wrote to memory of 1920 1804 msiexec.exe 30 PID 1804 wrote to memory of 1920 1804 msiexec.exe 30 PID 1804 wrote to memory of 1920 1804 msiexec.exe 30 PID 1920 wrote to memory of 1972 1920 cmd.exe 32 PID 1920 wrote to memory of 1972 1920 cmd.exe 32 PID 1920 wrote to memory of 1972 1920 cmd.exe 32 PID 1920 wrote to memory of 1972 1920 cmd.exe 32 PID 1804 wrote to memory of 1960 1804 msiexec.exe 33 PID 1804 wrote to memory of 1960 1804 msiexec.exe 33 PID 1804 wrote to memory of 1960 1804 msiexec.exe 33 PID 1804 wrote to memory of 1960 1804 msiexec.exe 33 PID 1960 wrote to memory of 1272 1960 cmd.exe 35 PID 1960 wrote to memory of 1272 1960 cmd.exe 35 PID 1960 wrote to memory of 1272 1960 cmd.exe 35 PID 1960 wrote to memory of 1272 1960 cmd.exe 35 PID 1272 wrote to memory of 1120 1272 net.exe 36 PID 1272 wrote to memory of 1120 1272 net.exe 36 PID 1272 wrote to memory of 1120 1272 net.exe 36 PID 1272 wrote to memory of 1120 1272 net.exe 36 PID 1804 wrote to memory of 1096 1804 msiexec.exe 37 PID 1804 wrote to memory of 1096 1804 msiexec.exe 37 PID 1804 wrote to memory of 1096 1804 msiexec.exe 37 PID 1804 wrote to memory of 1096 1804 msiexec.exe 37 PID 1096 wrote to memory of 1472 1096 cmd.exe 39 PID 1096 wrote to memory of 1472 1096 cmd.exe 39 PID 1096 wrote to memory of 1472 1096 cmd.exe 39 PID 1096 wrote to memory of 1472 1096 cmd.exe 39 PID 1804 wrote to memory of 324 1804 msiexec.exe 40 PID 1804 wrote to memory of 324 1804 msiexec.exe 40 PID 1804 wrote to memory of 324 1804 msiexec.exe 40 PID 1804 wrote to memory of 324 1804 msiexec.exe 40 PID 324 wrote to memory of 520 324 cmd.exe 42 PID 324 wrote to memory of 520 324 cmd.exe 42 PID 324 wrote to memory of 520 324 cmd.exe 42 PID 324 wrote to memory of 520 324 cmd.exe 42 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1276 set thread context of 1804 1276 rundll32.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1804 msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JEsNEuI.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JEsNEuI.dll,#12⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1276 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1804 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /all4⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all5⤵
- Modifies service
PID:1972
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net config workstation4⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\net.exenet config workstation5⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation6⤵PID:1120
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all4⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\net.exenet view /all5⤵
- Discovers systems in the same network
PID:1472
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all /domain4⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\net.exenet view /all /domain5⤵
- Discovers systems in the same network
PID:520
-
-
-
-