Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 06:26
Static task
static1
Behavioral task
behavioral1
Sample
Aquathai.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Aquathai.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
Aquathai.exe
-
Size
229KB
-
MD5
3a094dd4f2eb6544c5187e5c2f3d9608
-
SHA1
2177296edf001221312c26d26d6e446f25983d27
-
SHA256
b45fb97506ddaaddd21207b75f9a877fd65fedc6324fc10a7d16381bdef232a1
-
SHA512
f6d74bf140b661b69c2f56202fcc413a0081ce6fe48fd71d9f42e20c851dbc1037566f84ee4b90e132738ae7f0395328aee6dc6213f33dbebb067ec0b8e695e1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Aquathai.exeExplorer.EXEwlanext.exedescription pid process target process PID 1316 wrote to memory of 744 1316 Aquathai.exe Aquathai.exe PID 1316 wrote to memory of 744 1316 Aquathai.exe Aquathai.exe PID 1316 wrote to memory of 744 1316 Aquathai.exe Aquathai.exe PID 1316 wrote to memory of 744 1316 Aquathai.exe Aquathai.exe PID 1316 wrote to memory of 744 1316 Aquathai.exe Aquathai.exe PID 1316 wrote to memory of 744 1316 Aquathai.exe Aquathai.exe PID 1316 wrote to memory of 744 1316 Aquathai.exe Aquathai.exe PID 1280 wrote to memory of 304 1280 Explorer.EXE wlanext.exe PID 1280 wrote to memory of 304 1280 Explorer.EXE wlanext.exe PID 1280 wrote to memory of 304 1280 Explorer.EXE wlanext.exe PID 1280 wrote to memory of 304 1280 Explorer.EXE wlanext.exe PID 304 wrote to memory of 1076 304 wlanext.exe cmd.exe PID 304 wrote to memory of 1076 304 wlanext.exe cmd.exe PID 304 wrote to memory of 1076 304 wlanext.exe cmd.exe PID 304 wrote to memory of 1076 304 wlanext.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
Aquathai.exewlanext.exepid process 744 Aquathai.exe 744 Aquathai.exe 744 Aquathai.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe 304 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Aquathai.exewlanext.exepid process 744 Aquathai.exe 744 Aquathai.exe 744 Aquathai.exe 744 Aquathai.exe 304 wlanext.exe 304 wlanext.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Aquathai.exeAquathai.exewlanext.exedescription pid process target process PID 1316 set thread context of 744 1316 Aquathai.exe Aquathai.exe PID 744 set thread context of 1280 744 Aquathai.exe Explorer.EXE PID 744 set thread context of 1280 744 Aquathai.exe Explorer.EXE PID 304 set thread context of 1280 304 wlanext.exe Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Aquathai.exewlanext.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 744 Aquathai.exe Token: SeDebugPrivilege 304 wlanext.exe Token: SeShutdownPrivilege 1280 Explorer.EXE -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1076 cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Aquathai.exe"C:\Users\Admin\AppData\Local\Temp\Aquathai.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Aquathai.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Aquathai.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/304-5-0x0000000000000000-mapping.dmp
-
memory/304-6-0x0000000000320000-0x0000000000336000-memory.dmpFilesize
88KB
-
memory/304-8-0x0000000001DC0000-0x0000000001E7B000-memory.dmpFilesize
748KB
-
memory/744-2-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/744-3-0x000000000041E2E0-mapping.dmp
-
memory/1076-7-0x0000000000000000-mapping.dmp
-
memory/1280-4-0x00000000072B0000-0x00000000073F0000-memory.dmpFilesize
1.2MB
-
memory/1316-1-0x0000000000000000-0x0000000000000000-disk.dmp