Analysis
- max time kernel
66s - max time network
119s - platform
windows10_x64 - resource
win10 - submitted
06/07/2020, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe
- Size 2.4MB
- Sample200706-rm7ewemgen
- SHA256 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e
- MD5 ed37050fd303e01befbfded14f8d390f
- SHA1 5ab24f5427310e5088ad6af5e8bf8355ed1d38f5
- SHA512 52ed6a3ab57877f1e797708d030177ce8c38e255daf8ee17abb1dea7b3fd571f0c46b2229282cdf997a6177577606b6282b7d70e8876db567309218b49787eee
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1536 wrote to memory of 3020 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 67 PID 1536 wrote to memory of 3020 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 67 PID 1536 wrote to memory of 3020 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 67 PID 1536 wrote to memory of 3876 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 68 PID 1536 wrote to memory of 3876 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 68 PID 1536 wrote to memory of 3876 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 68 PID 1536 wrote to memory of 3880 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 69 PID 1536 wrote to memory of 3880 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 69 PID 1536 wrote to memory of 3880 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 69 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 PID 1536 wrote to memory of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1536 set thread context of 2328 1536 5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe 70 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe 2328 sethc.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2328 sethc.exe - Deletes itself 1 IoCs
pid Process 2328 sethc.exe -
resource yara_rule behavioral2/memory/2328-3-0x0000000000400000-0x0000000000994000-memory.dmp vmprotect behavioral2/memory/2328-5-0x0000000000400000-0x0000000000994000-memory.dmp vmprotect
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe"C:\Users\Admin\AppData\Local\Temp\5bf4e8074d911d75b85de2575920e22caab1e365640c013138b0ad856e2a972e.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1536 -
C:\Windows\SysWOW64\sethc.exe"C:\Windows\SysWOW64\sethc.exe"2⤵PID:3020
-
-
C:\Windows\SysWOW64\sethc.exe"C:\Windows\SysWOW64\sethc.exe"2⤵PID:3876
-
-
C:\Windows\SysWOW64\sethc.exe"C:\Windows\SysWOW64\sethc.exe"2⤵PID:3880
-
-
C:\Windows\SysWOW64\sethc.exe"C:\Windows\SysWOW64\sethc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Deletes itself
PID:2328
-