Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10_x64 -
resource
win10 -
submitted
19-07-2020 19:26
Static task
static1
Behavioral task
behavioral1
Sample
uncategorized_1.2.4.0.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
uncategorized_1.2.4.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
uncategorized_1.2.4.0.vir.exe
-
Size
677KB
-
MD5
8773b8aecd2979784c4b93ee890bd11d
-
SHA1
739bee3b3bbbf920f1483875ca880c8e49326448
-
SHA256
6c759b96dca08330cce6b7787e69b286d3b1a22a618f81409fd674ef720eb6dd
-
SHA512
2feb6cd4e6c0b9cc98580eb5fade79386b076fb3a62220dc64f212b0fadf8c6d9852d10053510c48e3b5d8b26d380b50bca921d559deb4b08ca2d1007525e84c
Score
8/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\Currentversion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\alhuagob = "C:\\Users\\Admin\\AppData\\Roaming\\Ukmayl\\ciqoa.exe" explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
uncategorized_1.2.4.0.vir.exedescription pid process Token: SeSecurityPrivilege 3068 uncategorized_1.2.4.0.vir.exe Token: SeSecurityPrivilege 3068 uncategorized_1.2.4.0.vir.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
uncategorized_1.2.4.0.vir.execiqoa.exedescription pid process target process PID 3068 wrote to memory of 3856 3068 uncategorized_1.2.4.0.vir.exe ciqoa.exe PID 3068 wrote to memory of 3856 3068 uncategorized_1.2.4.0.vir.exe ciqoa.exe PID 3068 wrote to memory of 3856 3068 uncategorized_1.2.4.0.vir.exe ciqoa.exe PID 3856 wrote to memory of 3956 3856 ciqoa.exe explorer.exe PID 3856 wrote to memory of 3956 3856 ciqoa.exe explorer.exe PID 3856 wrote to memory of 3956 3856 ciqoa.exe explorer.exe PID 3068 wrote to memory of 3360 3068 uncategorized_1.2.4.0.vir.exe cmd.exe PID 3068 wrote to memory of 3360 3068 uncategorized_1.2.4.0.vir.exe cmd.exe PID 3068 wrote to memory of 3360 3068 uncategorized_1.2.4.0.vir.exe cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
ciqoa.exepid process 3856 ciqoa.exe -
Suspicious behavior: MapViewOfSection 14 IoCs
Processes:
ciqoa.exeexplorer.exepid process 3856 ciqoa.exe 3856 ciqoa.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe -
Suspicious behavior: EnumeratesProcesses 562 IoCs
Processes:
explorer.exepid process 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe 3956 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\uncategorized_1.2.4.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\uncategorized_1.2.4.0.vir.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Ukmayl\ciqoa.exe"C:\Users\Admin\AppData\Roaming\Ukmayl\ciqoa.exe" -r2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\UNCATE~1.EXE >> NUL if exist C:\Users\Admin\AppData\Local\Temp\UNCATE~1.EXE goto repeat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Ukmayl\ciqoa.exe
-
C:\Users\Admin\AppData\Roaming\Ukmayl\ciqoa.exe
-
memory/3360-8-0x0000000000000000-mapping.dmp
-
memory/3360-9-0x0000000000000000-mapping.dmp
-
memory/3856-1-0x0000000000000000-mapping.dmp
-
memory/3956-5-0x0000000000000000-mapping.dmp
-
memory/3956-6-0x0000000001280000-0x00000000016BF000-memory.dmpFilesize
4.2MB
-
memory/3956-7-0x0000000001280000-0x00000000016BF000-memory.dmpFilesize
4.2MB