Analysis
-
max time kernel
139s -
max time network
131s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
29-06-2020 07:35
Static task
static1
Behavioral task
behavioral1
Sample
9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe
Resource
win10
General
-
Target
9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe
-
Size
184KB
-
MD5
1415244fa17fe0a50a7868e4b3984c39
-
SHA1
1de0d09d5731ee580de782ab6a090997a5403b46
-
SHA256
9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74
-
SHA512
3d14a122164b002b59fcd3722147fbb4b2a1706890056f2e0a28ff20217ad881ed5b2078588250423dba2df4a5f64642940afa8a4b288812662830e93239c6b3
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exedescription pid process target process PID 828 wrote to memory of 1820 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe schtasks.exe PID 828 wrote to memory of 1820 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe schtasks.exe PID 828 wrote to memory of 1820 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe schtasks.exe PID 828 wrote to memory of 1820 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe schtasks.exe PID 828 wrote to memory of 1776 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1776 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1776 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1776 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe PID 828 wrote to memory of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exedescription pid process Token: SeDebugPrivilege 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exepid process 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exedescription pid process target process PID 828 set thread context of 1764 828 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe"C:\Users\Admin\AppData\Local\Temp\9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ubguddaOdhjF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp68EF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp68EF.tmp
-
memory/828-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1764-4-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1764-5-0x000000000040C73E-mapping.dmp
-
memory/1764-6-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1764-7-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1820-2-0x0000000000000000-mapping.dmp