f9cff9e6050b1536e55014e7eafdc8827fb237e9235ff60265c5d1afaa5d5e6e

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7
submitted
27/06/2020, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe
Size 209KB
Sample200627-cvsgwsqdex
SHA256 f9cff9e6050b1536e55014e7eafdc8827fb237e9235ff60265c5d1afaa5d5e6e
MD5 d6b2ee3825a9869e0588e361c5fa004d
SHA1 2730abe52e015eff2b01c5fbe151a4bf5bbd83c0
SHA512 5fc071524e1dfad20b54817594069318a2ed25d49d27e02a319eb2fb86beb398daf41ab68989117cd50c803ad9d83f87b2b245a321b914dc0f7c5ba85670a749
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1872	schtasks.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1496 wrote to memory of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1496 wrote to memory of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1496 wrote to memory of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1496 wrote to memory of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1496 wrote to memory of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1496 wrote to memory of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1496 wrote to memory of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1496 wrote to memory of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1124 wrote to memory of 1760	1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	25
PID 1124 wrote to memory of 1760	1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	25
PID 1124 wrote to memory of 1760	1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	25
PID 1124 wrote to memory of 1760	1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	25
PID 1124 wrote to memory of 1768	1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	27
PID 1124 wrote to memory of 1768	1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	27
PID 1124 wrote to memory of 1768	1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	27
PID 1124 wrote to memory of 1768	1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	27
PID 1768 wrote to memory of 1856	1768	cmd.exe	29
PID 1768 wrote to memory of 1856	1768	cmd.exe	29
PID 1768 wrote to memory of 1856	1768	cmd.exe	29
PID 1768 wrote to memory of 1856	1768	cmd.exe	29
PID 1760 wrote to memory of 1872	1760	cmd.exe	30
PID 1760 wrote to memory of 1872	1760	cmd.exe	30
PID 1760 wrote to memory of 1872	1760	cmd.exe	30
PID 1760 wrote to memory of 1872	1760	cmd.exe	30
PID 1768 wrote to memory of 1904	1768	cmd.exe	31
PID 1768 wrote to memory of 1904	1768	cmd.exe	31
PID 1768 wrote to memory of 1904	1768	cmd.exe	31
PID 1768 wrote to memory of 1904	1768	cmd.exe	31
PID 1904 wrote to memory of 2036	1904	Googlechromee.exe	34
PID 1904 wrote to memory of 2036	1904	Googlechromee.exe	34
PID 1904 wrote to memory of 2036	1904	Googlechromee.exe	34
PID 1904 wrote to memory of 2036	1904	Googlechromee.exe	34
PID 1904 wrote to memory of 2036	1904	Googlechromee.exe	34
PID 1904 wrote to memory of 2036	1904	Googlechromee.exe	34
PID 1904 wrote to memory of 2036	1904	Googlechromee.exe	34
PID 1904 wrote to memory of 2036	1904	Googlechromee.exe	34
PID 1904 wrote to memory of 2036	1904	Googlechromee.exe	34

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1496 set thread context of 1124	1496	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe	24
PID 1904 set thread context of 2036	1904	Googlechromee.exe	34

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe
Token: SeDebugPrivilege	2036	Googlechromee.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe
1124	SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe

Loads dropped DLL 1 IoCs

pid	Process
1768	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1904	Googlechromee.exe
2036	Googlechromee.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1856	timeout.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1496
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Googlechromee" /tr '"C:\Users\Admin\AppData\Roaming\Googlechromee.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Googlechromee" /tr '"C:\Users\Admin\AppData\Roaming\Googlechromee.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8ED6.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    - Loads dropped DLL
    PID:1768
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1856
  - - C:\Users\Admin\AppData\Roaming\Googlechromee.exe
      "C:\Users\Admin\AppData\Roaming\Googlechromee.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      Suspicious use of SetThreadContext
      Executes dropped EXE
      PID:1904
    - - C:\Users\Admin\AppData\Roaming\Googlechromee.exe
        
        "C:\Users\Admin\AppData\Roaming\Googlechromee.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Executes dropped EXE
        
        PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-2-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1124-4-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1124-5-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2036-21-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2036-22-0x0000000000400000-0x0000000000412000-memory.dmp

Download