Analysis
- max time kernel
60s - max time network
64s - platform
windows7_x64 - resource
win7 - submitted
15/07/2020, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe
- Size 2.2MB
- Sample200715-pbhmxtsacx
- SHA256 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff
- MD5 61104bf5ed79a45cb1e62e7af3b3c25f
- SHA1 3e8f15effacf33c3c9beae055cac9e30082465aa
- SHA512 7cafa97731769c946610e5b70426517995a4a80813b79779b94df924dadbb9bfee1bacbec600785c8cc8f4f91d0325f750ddaebec4453ebeacb81d925cf2781b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe - Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1588 1492 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe 24 PID 1492 wrote to memory of 1588 1492 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe 24 PID 1492 wrote to memory of 1588 1492 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe 24 PID 1492 wrote to memory of 1588 1492 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe 24 PID 1492 wrote to memory of 1588 1492 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe 24 PID 1492 wrote to memory of 1588 1492 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe 24 PID 1588 wrote to memory of 532 1588 explorer.exe 25 PID 1588 wrote to memory of 532 1588 explorer.exe 25 PID 1588 wrote to memory of 532 1588 explorer.exe 25 PID 1588 wrote to memory of 532 1588 explorer.exe 25 PID 1588 wrote to memory of 556 1588 explorer.exe 26 PID 1588 wrote to memory of 556 1588 explorer.exe 26 PID 1588 wrote to memory of 556 1588 explorer.exe 26 PID 1588 wrote to memory of 556 1588 explorer.exe 26 PID 1588 wrote to memory of 556 1588 explorer.exe 26 PID 1588 wrote to memory of 556 1588 explorer.exe 26 PID 1588 wrote to memory of 556 1588 explorer.exe 26 PID 532 wrote to memory of 1508 532 @AE128.tmp.exe 27 PID 532 wrote to memory of 1508 532 @AE128.tmp.exe 27 PID 532 wrote to memory of 1508 532 @AE128.tmp.exe 27 PID 532 wrote to memory of 1508 532 @AE128.tmp.exe 27 PID 532 wrote to memory of 1744 532 @AE128.tmp.exe 29 PID 532 wrote to memory of 1744 532 @AE128.tmp.exe 29 PID 532 wrote to memory of 1744 532 @AE128.tmp.exe 29 PID 532 wrote to memory of 1744 532 @AE128.tmp.exe 29 PID 1508 wrote to memory of 1848 1508 cmd.exe 31 PID 1508 wrote to memory of 1848 1508 cmd.exe 31 PID 1508 wrote to memory of 1848 1508 cmd.exe 31 PID 1508 wrote to memory of 1848 1508 cmd.exe 31 PID 1848 wrote to memory of 1884 1848 WdExt.exe 32 PID 1848 wrote to memory of 1884 1848 WdExt.exe 32 PID 1848 wrote to memory of 1884 1848 WdExt.exe 32 PID 1848 wrote to memory of 1884 1848 WdExt.exe 32 PID 1884 wrote to memory of 1140 1884 cmd.exe 34 PID 1884 wrote to memory of 1140 1884 cmd.exe 34 PID 1884 wrote to memory of 1140 1884 cmd.exe 34 PID 1884 wrote to memory of 1140 1884 cmd.exe 34 PID 1884 wrote to memory of 1140 1884 cmd.exe 34 PID 1884 wrote to memory of 1140 1884 cmd.exe 34 PID 1884 wrote to memory of 1140 1884 cmd.exe 34 PID 1140 wrote to memory of 1928 1140 launch.exe 35 PID 1140 wrote to memory of 1928 1140 launch.exe 35 PID 1140 wrote to memory of 1928 1140 launch.exe 35 PID 1140 wrote to memory of 1928 1140 launch.exe 35 PID 1140 wrote to memory of 1928 1140 launch.exe 35 PID 1140 wrote to memory of 1928 1140 launch.exe 35 PID 1140 wrote to memory of 1928 1140 launch.exe 35 PID 1928 wrote to memory of 1572 1928 cmd.exe 37 PID 1928 wrote to memory of 1572 1928 cmd.exe 37 PID 1928 wrote to memory of 1572 1928 cmd.exe 37 PID 1928 wrote to memory of 1572 1928 cmd.exe 37 PID 1928 wrote to memory of 1572 1928 cmd.exe 37 PID 1928 wrote to memory of 1572 1928 cmd.exe 37 PID 1928 wrote to memory of 1572 1928 cmd.exe 37 PID 1572 wrote to memory of 1616 1572 wtmps.exe 38 PID 1572 wrote to memory of 1616 1572 wtmps.exe 38 PID 1572 wrote to memory of 1616 1572 wtmps.exe 38 PID 1572 wrote to memory of 1616 1572 wtmps.exe 38 PID 1572 wrote to memory of 1616 1572 wtmps.exe 38 PID 1572 wrote to memory of 1616 1572 wtmps.exe 38 PID 1572 wrote to memory of 1616 1572 wtmps.exe 38 - Loads dropped DLL 11 IoCs
pid Process 1588 explorer.exe 1588 explorer.exe 532 @AE128.tmp.exe 1588 explorer.exe 1508 cmd.exe 1508 cmd.exe 1848 WdExt.exe 1884 cmd.exe 1884 cmd.exe 1928 cmd.exe 1928 cmd.exe - Executes dropped EXE 6 IoCs
pid Process 532 @AE128.tmp.exe 556 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe 1848 WdExt.exe 1140 launch.exe 1572 wtmps.exe 1616 mscaps.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 532 @AE128.tmp.exe 1848 WdExt.exe 1140 launch.exe 1140 launch.exe 1140 launch.exe 1140 launch.exe 1140 launch.exe 1140 launch.exe 1140 launch.exe 1140 launch.exe 1140 launch.exe 1140 launch.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\SAP\SapSetup\LOGs\4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.log 4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe"C:\Users\Admin\AppData\Local\Temp\4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\@AE128.tmp.exe"C:\Users\Admin\AppData\Local\Temp\@AE128.tmp.exe"3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:532 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "4⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"5⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1848 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "6⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 18487⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
PID:1140 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "8⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"9⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1572 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe10⤵
- Executes dropped EXE
PID:1616
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "4⤵PID:1744
-
-
-
C:\Users\Admin\AppData\Local\Temp\4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe"C:\Users\Admin\AppData\Local\Temp\4381a308bc9ea8d3c7371878e8c8e0f4f031f8abfd83149df88af5a8ebdd9bff.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:556
-
-