Analysis
- max time kernel
132s - max time network
116s - platform
windows7_x64 - resource
win7v200430 - submitted
14/07/2020, 22:05
Static task
static1
Behavioral task
behavioral1
Sample
01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe
- Size 528KB
- Sample200714-md96tpkypn
- SHA256 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4
- MD5 d0b2a44417ce934cac3f7463d49380ca
- SHA1 77aca2a80de4857534c32ccd7e65119df20a4bef
- SHA512 689e844c867c8e5023a7038e9f70894e7d4cef8e7dc8cbc3a4bb172454884abc4692a3da67444544fa86cbc9a156dfee4653a563d58c43394e8837244731c73e
- MD5 SHA1 SHA512
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat hexawan.exe - Modifies data under HKEY_USERS 18 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB39BEE0-1D20-4E1F-BEFC-8B5E66D2E9F7}\WpadDecisionReason = "1" hexawan.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 hexawan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings hexawan.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070024000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 hexawan.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB39BEE0-1D20-4E1F-BEFC-8B5E66D2E9F7} hexawan.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 hexawan.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 6099bc9f3b5ad601 hexawan.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings hexawan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections hexawan.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB39BEE0-1D20-4E1F-BEFC-8B5E66D2E9F7}\WpadNetworkName = "Network" hexawan.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB39BEE0-1D20-4E1F-BEFC-8B5E66D2E9F7}\32-e2-17-db-d2-77 hexawan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad hexawan.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB39BEE0-1D20-4E1F-BEFC-8B5E66D2E9F7}\WpadDecision = "0" hexawan.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB39BEE0-1D20-4E1F-BEFC-8B5E66D2E9F7}\WpadDecisionTime = 6099bc9f3b5ad601 hexawan.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" hexawan.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" hexawan.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" hexawan.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 hexawan.exe - Suspicious behavior: EmotetMutantsSpam 2 IoCs
pid Process 476 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe 1036 hexawan.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1500 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe 476 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe 452 hexawan.exe 1036 hexawan.exe 1036 hexawan.exe 1036 hexawan.exe 1036 hexawan.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 476 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1500 wrote to memory of 476 1500 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe 24 PID 1500 wrote to memory of 476 1500 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe 24 PID 1500 wrote to memory of 476 1500 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe 24 PID 1500 wrote to memory of 476 1500 01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe 24 PID 452 wrote to memory of 1036 452 hexawan.exe 26 PID 452 wrote to memory of 1036 452 hexawan.exe 26 PID 452 wrote to memory of 1036 452 hexawan.exe 26 PID 452 wrote to memory of 1036 452 hexawan.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe"C:\Users\Admin\AppData\Local\Temp\01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe"C:\Users\Admin\AppData\Local\Temp\01658cd99bcc431e2b5d9116fb90f878bc1907077f0d16d91f7e8d7cc29605a4.exe"2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:476
-
-
C:\Windows\SysWOW64\hexawan.exe"C:\Windows\SysWOW64\hexawan.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\hexawan.exe"C:\Windows\SysWOW64\hexawan.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
PID:1036
-