Overview

overview

8

Static

static

tasks_196.vir.exe

windows7_x64

8

tasks_196.vir.exe

windows10_x64

8

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    19-07-2020 19:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tasks_196.vir.exe

  • Size

    229KB

  • MD5

    5bfda10184fb2ea0246db7f121bb9b22

  • SHA1

    b22541ca672cb19b440e222133da6f220fa9027e

  • SHA256

    6771d8d0431034fdd65f892475bfb38597457ccb65a7b2d46dd37579e22ebd4d

  • SHA512

    08bfa9e2ac0ae48186fb7705da0a4ac80a9d10e131d4cccee1624f93cdc2d3c6878e81130c173171c8decc4ec8db4d46bfa225c513f518cf6d51b33907f1dbb0

Score
8/10
persistence

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Drops file in Windows directory 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 104 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Adds Run key to start application
    PID:2992
    • C:\Users\Admin\AppData\Local\Temp\tasks_196.vir.exe
      "C:\Users\Admin\AppData\Local\Temp\tasks_196.vir.exe"
      2⤵
      • Drops file in Windows directory
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Users\Admin\AppData\Roaming\Ekludu\yqzan.exe
        "C:\Users\Admin\AppData\Roaming\Ekludu\yqzan.exe"
        3⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: EnumeratesProcesses
        PID:516
        • C:\Users\Admin\AppData\Roaming\Ekludu\yqzan.exe
          "C:\Users\Admin\AppData\Roaming\Ekludu\yqzan.exe" -child
          4⤵
          • Suspicious use of SetWindowsHookEx
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: EnumeratesProcesses
          PID:1128
          • C:\Windows\SysWOW64\ctfmon.exe
            ctfmon.exe
            5⤵
              PID:1552
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfcf0d1a9.bat"
          3⤵
            PID:1000
      • C:\Windows\SysWOW64\winsec32.exe
        "C:\Windows\SysWOW64\winsec32.exe" -service "C:\Users\Admin\AppData\Roaming\Ekludu\yqzan.exe"
        1⤵
        • Adds Run key to start application
        • Executes dropped EXE
        PID:3636

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\FW1FAYFO.cookie
        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\tmpfcf0d1a9.bat
        Download Submit
      • C:\Users\Admin\AppData\Roaming\Ekludu\yqzan.exe
        Download Submit
      • C:\Users\Admin\AppData\Roaming\Ekludu\yqzan.exe
        Download Submit
      • C:\Users\Admin\AppData\Roaming\Ekludu\yqzan.exe
        Download Submit
      • C:\Windows\SysWOW64\winsec32.exe
        Download Submit
      • C:\Windows\SysWOW64\winsec32.exe
        Download Submit
      • memory/516-3-0x0000000000000000-mapping.dmp
        Download
      • memory/1000-11-0x0000000000000000-mapping.dmp
        Download
      • memory/1128-13-0x0000000000000000-mapping.dmp
        Download
      • memory/1552-15-0x0000000000000000-mapping.dmp
        Download
      • memory/2992-5-0x0000000000E10000-0x0000000000E11000-memory.dmp
        Filesize

        4KB

        Download