Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:28
Static task
static1
Behavioral task
behavioral1
Sample
uncategorized_2.0.9.248.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
uncategorized_2.0.9.248.vir.exe
Resource
win10
General
-
Target
uncategorized_2.0.9.248.vir.exe
-
Size
135KB
-
MD5
e508a8a88e063c26507ec095b57a1f4f
-
SHA1
bdf10dece5ee332f0fda83a68225441a96036bba
-
SHA256
80e91c0ded60f7e85fbcba6239d2969c0910be5e0a5107a7f843ed2b30fb0ff9
-
SHA512
84838c5020257ad497dada42be4bdf01dacbbb37c906da466ebcd7184d446b37b34600bff3e8c5946bab9f9decedea814d1ae80bd3da19dd25fd177f30ed838d
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
uncategorized_2.0.9.248.vir.exeu1om.exedescription pid process target process PID 1204 wrote to memory of 852 1204 uncategorized_2.0.9.248.vir.exe u1om.exe PID 1204 wrote to memory of 852 1204 uncategorized_2.0.9.248.vir.exe u1om.exe PID 1204 wrote to memory of 852 1204 uncategorized_2.0.9.248.vir.exe u1om.exe PID 1204 wrote to memory of 852 1204 uncategorized_2.0.9.248.vir.exe u1om.exe PID 852 wrote to memory of 1112 852 u1om.exe taskhost.exe PID 852 wrote to memory of 1112 852 u1om.exe taskhost.exe PID 852 wrote to memory of 1112 852 u1om.exe taskhost.exe PID 852 wrote to memory of 1112 852 u1om.exe taskhost.exe PID 852 wrote to memory of 1112 852 u1om.exe taskhost.exe PID 852 wrote to memory of 1216 852 u1om.exe Dwm.exe PID 852 wrote to memory of 1216 852 u1om.exe Dwm.exe PID 852 wrote to memory of 1216 852 u1om.exe Dwm.exe PID 852 wrote to memory of 1216 852 u1om.exe Dwm.exe PID 852 wrote to memory of 1216 852 u1om.exe Dwm.exe PID 852 wrote to memory of 1276 852 u1om.exe Explorer.EXE PID 852 wrote to memory of 1276 852 u1om.exe Explorer.EXE PID 852 wrote to memory of 1276 852 u1om.exe Explorer.EXE PID 852 wrote to memory of 1276 852 u1om.exe Explorer.EXE PID 852 wrote to memory of 1276 852 u1om.exe Explorer.EXE PID 852 wrote to memory of 1204 852 u1om.exe uncategorized_2.0.9.248.vir.exe PID 852 wrote to memory of 1204 852 u1om.exe uncategorized_2.0.9.248.vir.exe PID 852 wrote to memory of 1204 852 u1om.exe uncategorized_2.0.9.248.vir.exe PID 852 wrote to memory of 1204 852 u1om.exe uncategorized_2.0.9.248.vir.exe PID 852 wrote to memory of 1204 852 u1om.exe uncategorized_2.0.9.248.vir.exe PID 852 wrote to memory of 1428 852 u1om.exe WinMail.exe PID 852 wrote to memory of 1428 852 u1om.exe WinMail.exe PID 852 wrote to memory of 1428 852 u1om.exe WinMail.exe PID 1204 wrote to memory of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe PID 1204 wrote to memory of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe PID 1204 wrote to memory of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe PID 1204 wrote to memory of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe PID 1204 wrote to memory of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe PID 1204 wrote to memory of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe PID 1204 wrote to memory of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe PID 1204 wrote to memory of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe PID 1204 wrote to memory of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe PID 852 wrote to memory of 1932 852 u1om.exe DllHost.exe PID 852 wrote to memory of 1932 852 u1om.exe DllHost.exe PID 852 wrote to memory of 1932 852 u1om.exe DllHost.exe PID 852 wrote to memory of 1932 852 u1om.exe DllHost.exe PID 852 wrote to memory of 1932 852 u1om.exe DllHost.exe PID 852 wrote to memory of 2032 852 u1om.exe DllHost.exe PID 852 wrote to memory of 2032 852 u1om.exe DllHost.exe PID 852 wrote to memory of 2032 852 u1om.exe DllHost.exe PID 852 wrote to memory of 2032 852 u1om.exe DllHost.exe PID 852 wrote to memory of 2032 852 u1om.exe DllHost.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
u1om.exepid process 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe 852 u1om.exe -
Processes:
uncategorized_2.0.9.248.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy uncategorized_2.0.9.248.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" uncategorized_2.0.9.248.vir.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
u1om.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run u1om.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{1431F7A9-A457-E636-85A2-61BB0055B013} = "C:\\Users\\Admin\\AppData\\Roaming\\Q89w\\u1om.exe" u1om.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1428 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uncategorized_2.0.9.248.vir.exedescription pid process target process PID 1204 set thread context of 1864 1204 uncategorized_2.0.9.248.vir.exe cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1864 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
uncategorized_2.0.9.248.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1204 uncategorized_2.0.9.248.vir.exe Token: SeManageVolumePrivilege 1428 WinMail.exe -
Loads dropped DLL 2 IoCs
Processes:
uncategorized_2.0.9.248.vir.exepid process 1204 uncategorized_2.0.9.248.vir.exe 1204 uncategorized_2.0.9.248.vir.exe -
Executes dropped EXE 1 IoCs
Processes:
u1om.exepid process 852 u1om.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1428 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1428 WinMail.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\131A2CEC-00000001.eml:OECustomProperty WinMail.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\uncategorized_2.0.9.248.vir.exe"C:\Users\Admin\AppData\Local\Temp\uncategorized_2.0.9.248.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Q89w\u1om.exe"C:\Users\Admin\AppData\Roaming\Q89w\u1om.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp59b1aaa9.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- NTFS ADS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp59b1aaa9.bat
-
C:\Users\Admin\AppData\Roaming\Q89w\u1om.exe
-
C:\Users\Admin\AppData\Roaming\Q89w\u1om.exe
-
\Users\Admin\AppData\Roaming\Q89w\u1om.exe
-
\Users\Admin\AppData\Roaming\Q89w\u1om.exe
-
memory/852-2-0x0000000000000000-mapping.dmp
-
memory/1428-5-0x00000000038E0000-0x00000000039E0000-memory.dmpFilesize
1024KB
-
memory/1428-7-0x00000000038E0000-0x0000000003AE0000-memory.dmpFilesize
2.0MB
-
memory/1428-9-0x00000000038E0000-0x00000000039E0000-memory.dmpFilesize
1024KB
-
memory/1428-10-0x00000000038E0000-0x0000000003AE0000-memory.dmpFilesize
2.0MB
-
memory/1428-11-0x00000000039E0000-0x0000000003AE0000-memory.dmpFilesize
1024KB
-
memory/1428-15-0x0000000002550000-0x0000000002552000-memory.dmpFilesize
8KB
-
memory/1428-16-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/1428-17-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/1428-18-0x0000000003C40000-0x0000000003C42000-memory.dmpFilesize
8KB
-
memory/1428-19-0x0000000002550000-0x0000000002552000-memory.dmpFilesize
8KB
-
memory/1428-20-0x0000000003EE0000-0x0000000003EE2000-memory.dmpFilesize
8KB
-
memory/1428-21-0x0000000003C90000-0x0000000003C92000-memory.dmpFilesize
8KB
-
memory/1428-22-0x0000000002550000-0x0000000002552000-memory.dmpFilesize
8KB
-
memory/1428-23-0x0000000003CA0000-0x0000000003CA2000-memory.dmpFilesize
8KB
-
memory/1428-24-0x0000000004080000-0x0000000004082000-memory.dmpFilesize
8KB
-
memory/1428-25-0x0000000004190000-0x0000000004192000-memory.dmpFilesize
8KB
-
memory/1428-26-0x00000000041B0000-0x00000000041B2000-memory.dmpFilesize
8KB
-
memory/1428-27-0x00000000044A0000-0x00000000044A2000-memory.dmpFilesize
8KB
-
memory/1428-28-0x0000000004670000-0x0000000004672000-memory.dmpFilesize
8KB
-
memory/1428-29-0x0000000003CA0000-0x0000000003CA2000-memory.dmpFilesize
8KB
-
memory/1428-30-0x0000000004080000-0x0000000004082000-memory.dmpFilesize
8KB
-
memory/1428-31-0x00000000044A0000-0x00000000044A2000-memory.dmpFilesize
8KB
-
memory/1428-32-0x0000000004240000-0x0000000004242000-memory.dmpFilesize
8KB
-
memory/1428-33-0x00000000044C0000-0x00000000044C2000-memory.dmpFilesize
8KB
-
memory/1428-34-0x0000000004670000-0x0000000004672000-memory.dmpFilesize
8KB
-
memory/1428-35-0x0000000003CA0000-0x0000000003CA2000-memory.dmpFilesize
8KB
-
memory/1428-36-0x00000000045D0000-0x00000000045D2000-memory.dmpFilesize
8KB
-
memory/1428-37-0x0000000003CC0000-0x0000000003CC2000-memory.dmpFilesize
8KB
-
memory/1428-38-0x0000000003D10000-0x0000000003D12000-memory.dmpFilesize
8KB
-
memory/1428-39-0x00000000040B0000-0x00000000040B2000-memory.dmpFilesize
8KB
-
memory/1428-41-0x0000000003D00000-0x0000000003D02000-memory.dmpFilesize
8KB
-
memory/1428-40-0x00000000040A0000-0x00000000040A2000-memory.dmpFilesize
8KB
-
memory/1428-42-0x0000000003CB0000-0x0000000003CB2000-memory.dmpFilesize
8KB
-
memory/1428-43-0x0000000004000000-0x0000000004002000-memory.dmpFilesize
8KB
-
memory/1428-44-0x0000000004010000-0x0000000004012000-memory.dmpFilesize
8KB
-
memory/1428-45-0x0000000003C50000-0x0000000003C52000-memory.dmpFilesize
8KB
-
memory/1428-46-0x00000000040C0000-0x00000000040C2000-memory.dmpFilesize
8KB
-
memory/1428-47-0x0000000003D10000-0x0000000003D12000-memory.dmpFilesize
8KB
-
memory/1428-48-0x0000000003D30000-0x0000000003D32000-memory.dmpFilesize
8KB
-
memory/1428-49-0x0000000004090000-0x0000000004092000-memory.dmpFilesize
8KB
-
memory/1428-50-0x00000000038E0000-0x00000000039E0000-memory.dmpFilesize
1024KB
-
memory/1428-52-0x00000000023A0000-0x00000000023B0000-memory.dmpFilesize
64KB
-
memory/1428-58-0x00000000021B0000-0x00000000021C0000-memory.dmpFilesize
64KB
-
memory/1864-64-0x0000000000050000-0x0000000000076000-memory.dmpFilesize
152KB
-
memory/1864-65-0x000000000006111B-mapping.dmp