Resubmissions
13/01/2024, 10:35
240113-mm1zzshda813/01/2024, 10:35
240113-mmndwshch91009/07/2020, 11:15
200709-954vxj2xke8Analysis
- max time kernel
149s - max time network
150s - platform
windows10_x64 - resource
win10v200430 - submitted
09/07/2020, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe
- Size 1.3MB
- Sample200709-954vxj2xke
- SHA256 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46
- MD5 2042fdc08ed48544a98307aec4610251
- SHA1 50a6c64a62347c6c87abb65d04803ff23832a7e8
- SHA512 b102fc8105b0a7cca5c33711e83af818dd9c37ff377d252edec69cbb05052387013426bbce38650c0360fb8c94f4796a8232b93f4c5d438caf031a50c4cae591
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- ServiceHost packer 6 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/1788-9-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1788-10-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1788-11-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1788-12-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1788-13-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1788-14-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 1788 ProAlts.xyz Token Generator.exe 2072 WinServices.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 icanhazip.com - Modifies service 2 TTPs 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for SqlServer\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage WinServices.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rdyboost\Performance\1023 = "132387741355857358" WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for Oracle\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking 4.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage WinServices.exe - Program crash 1 IoCs
pid pid_target Process procid_target 64 1788 WerFault.exe 68 - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4004 schtasks.exe - Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 64 WerFault.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe 2072 WinServices.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2072 WinServices.exe Token: SeRestorePrivilege 64 WerFault.exe Token: SeBackupPrivilege 64 WerFault.exe Token: SeDebugPrivilege 64 WerFault.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1788 1720 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe 68 PID 1720 wrote to memory of 1788 1720 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe 68 PID 1720 wrote to memory of 1788 1720 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe 68 PID 1720 wrote to memory of 2072 1720 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe 69 PID 1720 wrote to memory of 2072 1720 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe 69 PID 1720 wrote to memory of 2072 1720 fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe 69 PID 2072 wrote to memory of 3832 2072 WinServices.exe 73 PID 2072 wrote to memory of 3832 2072 WinServices.exe 73 PID 2072 wrote to memory of 3832 2072 WinServices.exe 73 PID 3832 wrote to memory of 4004 3832 cmd.exe 75 PID 3832 wrote to memory of 4004 3832 cmd.exe 75 PID 3832 wrote to memory of 4004 3832 cmd.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe"C:\Users\Admin\AppData\Local\Temp\fac551f8ff156743a7f41bf36684691e87dfb123c027ea0541b962b3162e4c46.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\ProgramData\ProAlts.xyz Token Generator.exe"C:\ProgramData\ProAlts.xyz Token Generator.exe"2⤵
- Executes dropped EXE
PID:1788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 10883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:64
-
-
-
C:\ProgramData\WinServices.exe"C:\ProgramData\WinServices.exe"2⤵
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"'4⤵
- Creates scheduled task(s)
PID:4004
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1152