Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7 -
submitted
29-06-2020 07:29
Static task
static1
Behavioral task
behavioral1
Sample
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe
Resource
win7
Behavioral task
behavioral2
Sample
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe
Resource
win10v200430
General
-
Target
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe
-
Size
300KB
-
MD5
2a4f55e3cee56751331314b2357bac87
-
SHA1
8750c27c58467b1c05e9912ce80ecce524ff3c38
-
SHA256
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19
-
SHA512
e2fa380ce7daa64eb9854204625d422d94b6af310f3ffefbd5b3daf59dbda91ff236f3e5559d3f1f9794239e448317c3295c3f264021f9e5d2dbb1073b77cb1d
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exed83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exeibis.exepid process 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe 1100 ibis.exe 1100 ibis.exe -
Suspicious use of WriteProcessMemory 66 IoCs
Processes:
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exed83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exeibis.exeibis.exedescription pid process target process PID 284 wrote to memory of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 284 wrote to memory of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 284 wrote to memory of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 284 wrote to memory of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 284 wrote to memory of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 284 wrote to memory of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 284 wrote to memory of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 284 wrote to memory of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 284 wrote to memory of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 304 wrote to memory of 1100 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe ibis.exe PID 304 wrote to memory of 1100 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe ibis.exe PID 304 wrote to memory of 1100 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe ibis.exe PID 304 wrote to memory of 1100 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe ibis.exe PID 1100 wrote to memory of 1644 1100 ibis.exe ibis.exe PID 1100 wrote to memory of 1644 1100 ibis.exe ibis.exe PID 1100 wrote to memory of 1644 1100 ibis.exe ibis.exe PID 1100 wrote to memory of 1644 1100 ibis.exe ibis.exe PID 1100 wrote to memory of 1644 1100 ibis.exe ibis.exe PID 1100 wrote to memory of 1644 1100 ibis.exe ibis.exe PID 1100 wrote to memory of 1644 1100 ibis.exe ibis.exe PID 1100 wrote to memory of 1644 1100 ibis.exe ibis.exe PID 1100 wrote to memory of 1644 1100 ibis.exe ibis.exe PID 304 wrote to memory of 1780 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe cmd.exe PID 304 wrote to memory of 1780 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe cmd.exe PID 304 wrote to memory of 1780 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe cmd.exe PID 304 wrote to memory of 1780 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe cmd.exe PID 1644 wrote to memory of 1152 1644 ibis.exe taskhost.exe PID 1644 wrote to memory of 1152 1644 ibis.exe taskhost.exe PID 1644 wrote to memory of 1152 1644 ibis.exe taskhost.exe PID 1644 wrote to memory of 1152 1644 ibis.exe taskhost.exe PID 1644 wrote to memory of 1152 1644 ibis.exe taskhost.exe PID 1644 wrote to memory of 1216 1644 ibis.exe Dwm.exe PID 1644 wrote to memory of 1216 1644 ibis.exe Dwm.exe PID 1644 wrote to memory of 1216 1644 ibis.exe Dwm.exe PID 1644 wrote to memory of 1216 1644 ibis.exe Dwm.exe PID 1644 wrote to memory of 1216 1644 ibis.exe Dwm.exe PID 1644 wrote to memory of 1268 1644 ibis.exe Explorer.EXE PID 1644 wrote to memory of 1268 1644 ibis.exe Explorer.EXE PID 1644 wrote to memory of 1268 1644 ibis.exe Explorer.EXE PID 1644 wrote to memory of 1268 1644 ibis.exe Explorer.EXE PID 1644 wrote to memory of 1268 1644 ibis.exe Explorer.EXE PID 1644 wrote to memory of 304 1644 ibis.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 1644 wrote to memory of 304 1644 ibis.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 1644 wrote to memory of 304 1644 ibis.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 1644 wrote to memory of 304 1644 ibis.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 1644 wrote to memory of 304 1644 ibis.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 1644 wrote to memory of 1780 1644 ibis.exe cmd.exe PID 1644 wrote to memory of 1780 1644 ibis.exe cmd.exe PID 1644 wrote to memory of 1780 1644 ibis.exe cmd.exe PID 1644 wrote to memory of 1780 1644 ibis.exe cmd.exe PID 1644 wrote to memory of 1780 1644 ibis.exe cmd.exe PID 1644 wrote to memory of 1896 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 1896 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 1896 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 1896 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 1896 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 1204 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 1204 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 1204 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 1204 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 1204 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 520 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 520 1644 ibis.exe DllHost.exe PID 1644 wrote to memory of 520 1644 ibis.exe DllHost.exe -
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exeibis.exedescription pid process target process PID 284 set thread context of 304 284 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe PID 1100 set thread context of 1644 1100 ibis.exe ibis.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exedescription pid process Token: SeSecurityPrivilege 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe Token: SeSecurityPrivilege 304 d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe -
Executes dropped EXE 2 IoCs
Processes:
ibis.exeibis.exepid process 1100 ibis.exe 1644 ibis.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
ibis.exepid process 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe 1644 ibis.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1780 cmd.exe -
NSIS installer 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Kukyqi\ibis.exe nsis_installer C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe nsis_installer C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe nsis_installer C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe nsis_installer -
Adds Run entry to start application 2 TTPs 3 IoCs
Processes:
ibis.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Igqeer = "C:\\Users\\Admin\\AppData\\Roaming\\Kukyqi\\ibis.exe" ibis.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run ibis.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\Currentversion\Run ibis.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe"C:\Users\Admin\AppData\Local\Temp\d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe"C:\Users\Admin\AppData\Local\Temp\d83e3f5b248bc0b1676bb081cd50e8df0dd600f4b9253465aa6ed63f263cfd19.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe"C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe"C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe"5⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp04f9e37c.bat"4⤵
- Modifies Internet Explorer settings
- Deletes itself
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp04f9e37c.bat
-
C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe
-
C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe
-
C:\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe
-
\Users\Admin\AppData\Local\Temp\nsq1E2B.tmp\sHkWWksrWFRGrUE.dll
-
\Users\Admin\AppData\Local\Temp\nsq1E2B.tmp\writer.dll
-
\Users\Admin\AppData\Local\Temp\nsv17E4.tmp\sHkWWksrWFRGrUE.dll
-
\Users\Admin\AppData\Local\Temp\nsv17E4.tmp\writer.dll
-
\Users\Admin\AppData\Roaming\Kukyqi\ibis.exe
-
memory/284-2-0x0000000000287000-0x0000000000289000-memory.dmpFilesize
8KB
-
memory/304-4-0x000000000042B055-mapping.dmp
-
memory/304-5-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/304-3-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/1100-7-0x0000000000000000-mapping.dmp
-
memory/1100-12-0x00000000007A7000-0x00000000007A9000-memory.dmpFilesize
8KB
-
memory/1644-15-0x000000000042B055-mapping.dmp
-
memory/1780-18-0x0000000000000000-mapping.dmp
-
memory/1780-19-0x0000000000000000-mapping.dmp