Resubmissions
24-01-2024 07:29
240124-jbnczachd9 1023-01-2024 11:54
240123-n2wjgsafc6 1026-06-2020 08:43
200626-953qfplyej 10Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
26-06-2020 08:43
Static task
static1
Behavioral task
behavioral1
Sample
xiynk.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
xiynk.dll
-
Size
356KB
-
MD5
e83a8a849188b48e79a6f49dd0c7ae91
-
SHA1
55a1669550d823104e1452f0e6a0a94c3f7fae12
-
SHA256
a97b7b2353dc9012b6cb914f6665d0e93f557859411d2e08b942316c09d7b07f
-
SHA512
b035faff865f72977879322f9d1c08c6f87c96a8805db76a0e5ae4b6118f2b075e58bb1cc6a9cee8ce1c51763301443bab40970ad1f072a1763d7d7727e477f4
Score
10/10
Malware Config
Signatures
-
Modifies service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas ipconfig.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 1772 msiexec.exe Token: SeSecurityPrivilege 1772 msiexec.exe -
Blacklisted process makes network request 12 IoCs
flow pid Process 8 1772 msiexec.exe 9 1772 msiexec.exe 10 1772 msiexec.exe 11 1772 msiexec.exe 12 1772 msiexec.exe 13 1772 msiexec.exe 14 1772 msiexec.exe 15 1772 msiexec.exe 16 1772 msiexec.exe 17 1772 msiexec.exe 18 1772 msiexec.exe 19 1772 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1772 msiexec.exe -
Runs net.exe
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 652 net.exe 1368 net.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 608 wrote to memory of 1184 608 rundll32.exe 24 PID 608 wrote to memory of 1184 608 rundll32.exe 24 PID 608 wrote to memory of 1184 608 rundll32.exe 24 PID 608 wrote to memory of 1184 608 rundll32.exe 24 PID 608 wrote to memory of 1184 608 rundll32.exe 24 PID 608 wrote to memory of 1184 608 rundll32.exe 24 PID 608 wrote to memory of 1184 608 rundll32.exe 24 PID 1184 wrote to memory of 1772 1184 rundll32.exe 27 PID 1184 wrote to memory of 1772 1184 rundll32.exe 27 PID 1184 wrote to memory of 1772 1184 rundll32.exe 27 PID 1184 wrote to memory of 1772 1184 rundll32.exe 27 PID 1184 wrote to memory of 1772 1184 rundll32.exe 27 PID 1184 wrote to memory of 1772 1184 rundll32.exe 27 PID 1184 wrote to memory of 1772 1184 rundll32.exe 27 PID 1184 wrote to memory of 1772 1184 rundll32.exe 27 PID 1184 wrote to memory of 1772 1184 rundll32.exe 27 PID 1772 wrote to memory of 1896 1772 msiexec.exe 30 PID 1772 wrote to memory of 1896 1772 msiexec.exe 30 PID 1772 wrote to memory of 1896 1772 msiexec.exe 30 PID 1772 wrote to memory of 1896 1772 msiexec.exe 30 PID 1896 wrote to memory of 1960 1896 cmd.exe 32 PID 1896 wrote to memory of 1960 1896 cmd.exe 32 PID 1896 wrote to memory of 1960 1896 cmd.exe 32 PID 1896 wrote to memory of 1960 1896 cmd.exe 32 PID 1772 wrote to memory of 1216 1772 msiexec.exe 33 PID 1772 wrote to memory of 1216 1772 msiexec.exe 33 PID 1772 wrote to memory of 1216 1772 msiexec.exe 33 PID 1772 wrote to memory of 1216 1772 msiexec.exe 33 PID 1216 wrote to memory of 2016 1216 cmd.exe 35 PID 1216 wrote to memory of 2016 1216 cmd.exe 35 PID 1216 wrote to memory of 2016 1216 cmd.exe 35 PID 1216 wrote to memory of 2016 1216 cmd.exe 35 PID 2016 wrote to memory of 988 2016 net.exe 36 PID 2016 wrote to memory of 988 2016 net.exe 36 PID 2016 wrote to memory of 988 2016 net.exe 36 PID 2016 wrote to memory of 988 2016 net.exe 36 PID 1772 wrote to memory of 1472 1772 msiexec.exe 37 PID 1772 wrote to memory of 1472 1772 msiexec.exe 37 PID 1772 wrote to memory of 1472 1772 msiexec.exe 37 PID 1772 wrote to memory of 1472 1772 msiexec.exe 37 PID 1472 wrote to memory of 652 1472 cmd.exe 39 PID 1472 wrote to memory of 652 1472 cmd.exe 39 PID 1472 wrote to memory of 652 1472 cmd.exe 39 PID 1472 wrote to memory of 652 1472 cmd.exe 39 PID 1772 wrote to memory of 756 1772 msiexec.exe 40 PID 1772 wrote to memory of 756 1772 msiexec.exe 40 PID 1772 wrote to memory of 756 1772 msiexec.exe 40 PID 1772 wrote to memory of 756 1772 msiexec.exe 40 PID 756 wrote to memory of 1368 756 cmd.exe 42 PID 756 wrote to memory of 1368 756 cmd.exe 42 PID 756 wrote to memory of 1368 756 cmd.exe 42 PID 756 wrote to memory of 1368 756 cmd.exe 42 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1184 set thread context of 1772 1184 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\xiynk.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\xiynk.dll,#12⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1184 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /all4⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all5⤵
- Modifies service
PID:1960
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net config workstation4⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\net.exenet config workstation5⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation6⤵PID:988
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all4⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\net.exenet view /all5⤵
- Discovers systems in the same network
PID:652
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all /domain4⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\net.exenet view /all /domain5⤵
- Discovers systems in the same network
PID:1368
-
-
-
-