Analysis
-
max time kernel
76s -
max time network
137s -
platform
windows10_x64 -
resource
win10 -
submitted
09-07-2020 20:23
Static task
static1
Behavioral task
behavioral1
Sample
Customs Form K1.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Customs Form K1.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
Customs Form K1.exe
-
Size
965KB
-
MD5
10888cbc0356d7ed153c9d646e650b67
-
SHA1
fe0d31a7ee4cae23de596186512c6af1310ead4c
-
SHA256
df6e5a970596d544e6f644924cafadda5a596e2337621ea98829bd36801fa02c
-
SHA512
a64b4b9e5525a6c609d1eac830a25d7d95e3ab9b6c9374130728bbdd8ddd492676cb8bb60d39139aadf18e8f7adf715d222b5596d7df601b8317cda78dc335c9
Score
8/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Customs Form K1.exeCustoms Form K1.exedescription pid process Token: SeDebugPrivilege 2600 Customs Form K1.exe Token: SeDebugPrivilege 3916 Customs Form K1.exe Token: SeDebugPrivilege 3916 Customs Form K1.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Customs Form K1.exeCustoms Form K1.exepid process 2600 Customs Form K1.exe 2600 Customs Form K1.exe 3916 Customs Form K1.exe 3916 Customs Form K1.exe 3916 Customs Form K1.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Customs Form K1.exedescription pid process target process PID 2600 wrote to memory of 3916 2600 Customs Form K1.exe Customs Form K1.exe PID 2600 wrote to memory of 3916 2600 Customs Form K1.exe Customs Form K1.exe PID 2600 wrote to memory of 3916 2600 Customs Form K1.exe Customs Form K1.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Customs Form K1.exepid process 2600 Customs Form K1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Customs Form K1.exedescription pid process target process PID 2600 set thread context of 3916 2600 Customs Form K1.exe Customs Form K1.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/3916-1-0x0000000000400000-0x0000000000564000-memory.dmp upx behavioral2/memory/3916-3-0x0000000000400000-0x0000000000564000-memory.dmp upx behavioral2/memory/3916-6-0x0000000000400000-0x0000000000564000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
Processes:
Customs Form K1.exedescription ioc process File created C:\Program Files\Common Files\System\symsrv.dll Customs Form K1.exe -
Loads dropped DLL 2 IoCs
Processes:
Customs Form K1.exeCustoms Form K1.exepid process 2600 Customs Form K1.exe 3916 Customs Form K1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Customs Form K1.exe"C:\Users\Admin\AppData\Local\Temp\Customs Form K1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Customs Form K1.exe"C:\Users\Admin\AppData\Local\Temp\Customs Form K1.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRA~1\COMMON~1\System\symsrv.dll
-
\Program Files\Common Files\System\symsrv.dll
-
\Program Files\Common Files\System\symsrv.dll
-
memory/3916-1-0x0000000000400000-0x0000000000564000-memory.dmpFilesize
1.4MB
-
memory/3916-2-0x00000000005621E0-mapping.dmp
-
memory/3916-3-0x0000000000400000-0x0000000000564000-memory.dmpFilesize
1.4MB
-
memory/3916-6-0x0000000000400000-0x0000000000564000-memory.dmpFilesize
1.4MB
-
memory/3916-7-0x0000000002B30000-0x0000000002BDC000-memory.dmpFilesize
688KB
-
memory/3916-8-0x0000000002A82000-0x0000000002A83000-memory.dmpFilesize
4KB
-
memory/3916-9-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB