Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:37
Static task
static1
Behavioral task
behavioral1
Sample
sphinx_1.0.1.2.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
sphinx_1.0.1.2.vir.exe
Resource
win10v200430
General
-
Target
sphinx_1.0.1.2.vir.exe
-
Size
1.5MB
-
MD5
36bb5464092459c07fc4a5014304d072
-
SHA1
345864026b571328aa2deeb9c2fc62fa75e5e847
-
SHA256
b7969b30d717867cea9427b87a822d59edd94600312599cf407d0d6ec35988ed
-
SHA512
e0effbbc9f59288094e9becbdc4c40304586b45ee3d1cec1ba16e086a6754e5aa2e03b0336a9253c704581d5673d8d4dcde0a0843a08a38e77ab3489d7ac723d
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
Processes:
sphinx_1.0.1.2.vir.exesphinx_1.0.1.2.vir.execoka.exepid process 1164 sphinx_1.0.1.2.vir.exe 1164 sphinx_1.0.1.2.vir.exe 1344 sphinx_1.0.1.2.vir.exe 1080 coka.exe 1080 coka.exe -
Executes dropped EXE 2 IoCs
Processes:
coka.execoka.exepid process 1080 coka.exe 2044 coka.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 316 WinMail.exe -
NSIS installer 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Yxugu\coka.exe nsis_installer C:\Users\Admin\AppData\Roaming\Yxugu\coka.exe nsis_installer C:\Users\Admin\AppData\Roaming\Yxugu\coka.exe nsis_installer C:\Users\Admin\AppData\Roaming\Yxugu\coka.exe nsis_installer -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
coka.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run coka.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{864A833F-F681-E237-8B83-8D86EB52663F} = "C:\\Users\\Admin\\AppData\\Roaming\\Yxugu\\coka.exe" coka.exe -
Suspicious use of WriteProcessMemory 106 IoCs
Processes:
sphinx_1.0.1.2.vir.exesphinx_1.0.1.2.vir.execoka.execoka.exedescription pid process target process PID 1164 wrote to memory of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1164 wrote to memory of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1164 wrote to memory of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1164 wrote to memory of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1164 wrote to memory of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1164 wrote to memory of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1164 wrote to memory of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1164 wrote to memory of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1164 wrote to memory of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1344 wrote to memory of 1484 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1484 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1484 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1484 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1512 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1512 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1512 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1512 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 284 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 284 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 284 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 284 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 284 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 284 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 284 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 284 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 wrote to memory of 1080 1344 sphinx_1.0.1.2.vir.exe coka.exe PID 1344 wrote to memory of 1080 1344 sphinx_1.0.1.2.vir.exe coka.exe PID 1344 wrote to memory of 1080 1344 sphinx_1.0.1.2.vir.exe coka.exe PID 1344 wrote to memory of 1080 1344 sphinx_1.0.1.2.vir.exe coka.exe PID 1080 wrote to memory of 2044 1080 coka.exe coka.exe PID 1080 wrote to memory of 2044 1080 coka.exe coka.exe PID 1080 wrote to memory of 2044 1080 coka.exe coka.exe PID 1080 wrote to memory of 2044 1080 coka.exe coka.exe PID 1080 wrote to memory of 2044 1080 coka.exe coka.exe PID 1080 wrote to memory of 2044 1080 coka.exe coka.exe PID 1080 wrote to memory of 2044 1080 coka.exe coka.exe PID 1080 wrote to memory of 2044 1080 coka.exe coka.exe PID 1080 wrote to memory of 2044 1080 coka.exe coka.exe PID 1344 wrote to memory of 1480 1344 sphinx_1.0.1.2.vir.exe cmd.exe PID 1344 wrote to memory of 1480 1344 sphinx_1.0.1.2.vir.exe cmd.exe PID 1344 wrote to memory of 1480 1344 sphinx_1.0.1.2.vir.exe cmd.exe PID 1344 wrote to memory of 1480 1344 sphinx_1.0.1.2.vir.exe cmd.exe PID 2044 wrote to memory of 1172 2044 coka.exe taskhost.exe PID 2044 wrote to memory of 1172 2044 coka.exe taskhost.exe PID 2044 wrote to memory of 1172 2044 coka.exe taskhost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
sphinx_1.0.1.2.vir.exeexplorer.exeWinMail.exedescription pid process Token: SeDebugPrivilege 1344 sphinx_1.0.1.2.vir.exe Token: SeDebugPrivilege 1344 sphinx_1.0.1.2.vir.exe Token: SeDebugPrivilege 1344 sphinx_1.0.1.2.vir.exe Token: SeSecurityPrivilege 1344 sphinx_1.0.1.2.vir.exe Token: SeDebugPrivilege 284 explorer.exe Token: SeDebugPrivilege 284 explorer.exe Token: SeDebugPrivilege 284 explorer.exe Token: SeManageVolumePrivilege 316 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 316 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 316 WinMail.exe -
Processes:
resource yara_rule behavioral1/memory/284-5-0x0000000000400000-0x00000000007A5000-memory.dmp upx behavioral1/memory/284-9-0x0000000000400000-0x00000000007A5000-memory.dmp upx behavioral1/memory/284-11-0x0000000000400000-0x00000000007A5000-memory.dmp upx -
Suspicious use of SetThreadContext 4 IoCs
Processes:
sphinx_1.0.1.2.vir.exesphinx_1.0.1.2.vir.execoka.exedescription pid process target process PID 1164 set thread context of 1344 1164 sphinx_1.0.1.2.vir.exe sphinx_1.0.1.2.vir.exe PID 1344 set thread context of 284 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1344 set thread context of 1632 1344 sphinx_1.0.1.2.vir.exe explorer.exe PID 1080 set thread context of 2044 1080 coka.exe coka.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
sphinx_1.0.1.2.vir.exeexplorer.execoka.exeexplorer.exepid process 1344 sphinx_1.0.1.2.vir.exe 1344 sphinx_1.0.1.2.vir.exe 1344 sphinx_1.0.1.2.vir.exe 284 explorer.exe 284 explorer.exe 2044 coka.exe 284 explorer.exe 284 explorer.exe 284 explorer.exe 1632 explorer.exe 1632 explorer.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe 2044 coka.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1480 cmd.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" explorer.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\55EC10C6-00000001.eml:OECustomProperty WinMail.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\sphinx_1.0.1.2.vir.exe"C:\Users\Admin\AppData\Local\Temp\sphinx_1.0.1.2.vir.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\sphinx_1.0.1.2.vir.exeC:\Users\Admin\AppData\Local\Temp\sphinx_1.0.1.2.vir.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe" socksParentProxy=localhost:90504⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Yxugu\coka.exe"C:\Users\Admin\AppData\Roaming\Yxugu\coka.exe"4⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Yxugu\coka.exeC:\Users\Admin\AppData\Roaming\Yxugu\coka.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp823d7568.bat"4⤵
- Deletes itself
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-930627336717092758-2128894480-464065897151423602-16522351-2102513926104595469"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1508646070309076754-1472964524-162616527121187006902845177877000600791654416004"1⤵
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- NTFS ADS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp823d7568.bat
-
C:\Users\Admin\AppData\Roaming\25-unhint-nonlatin.conf
-
C:\Users\Admin\AppData\Roaming\BatheUredosporeCosmology
-
C:\Users\Admin\AppData\Roaming\OS Shortcuts.txt
-
C:\Users\Admin\AppData\Roaming\Yxugu\coka.exe
-
C:\Users\Admin\AppData\Roaming\Yxugu\coka.exe
-
C:\Users\Admin\AppData\Roaming\Yxugu\coka.exe
-
C:\Users\Admin\AppData\Roaming\arrow_left_enabled.png
-
C:\Users\Admin\AppData\Roaming\nourishments.dll
-
C:\Users\Admin\AppData\Roaming\olduninstall.iss
-
C:\Users\Admin\AppData\Roaming\pcdrdvdminusrw.p5m
-
\Users\Admin\AppData\Local\Temp\nsf4E5F.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nsq10C4.tmp\System.dll
-
\Users\Admin\AppData\Roaming\Yxugu\coka.exe
-
\Users\Admin\AppData\Roaming\nourishments.dll
-
\Users\Admin\AppData\Roaming\nourishments.dll
-
memory/284-6-0x00000000007A34B0-mapping.dmp
-
memory/284-109-0x0000000003310000-0x0000000003321000-memory.dmpFilesize
68KB
-
memory/284-15-0x0000000003310000-0x0000000003321000-memory.dmpFilesize
68KB
-
memory/284-13-0x0000000003720000-0x0000000003731000-memory.dmpFilesize
68KB
-
memory/284-12-0x0000000003310000-0x0000000003321000-memory.dmpFilesize
68KB
-
memory/284-11-0x0000000000400000-0x00000000007A5000-memory.dmpFilesize
3.6MB
-
memory/284-110-0x0000000003720000-0x0000000003731000-memory.dmpFilesize
68KB
-
memory/284-9-0x0000000000400000-0x00000000007A5000-memory.dmpFilesize
3.6MB
-
memory/284-111-0x0000000003310000-0x0000000003321000-memory.dmpFilesize
68KB
-
memory/284-5-0x0000000000400000-0x00000000007A5000-memory.dmpFilesize
3.6MB
-
memory/284-408-0x00000000007A34B0-mapping.dmp
-
memory/316-415-0x0000000003AC0000-0x0000000003BC0000-memory.dmpFilesize
1024KB
-
memory/316-432-0x0000000004280000-0x0000000004282000-memory.dmpFilesize
8KB
-
memory/316-464-0x0000000001FA0000-0x0000000001FB0000-memory.dmpFilesize
64KB
-
memory/316-458-0x0000000002190000-0x00000000021A0000-memory.dmpFilesize
64KB
-
memory/316-456-0x00000000039C0000-0x0000000003AC0000-memory.dmpFilesize
1024KB
-
memory/316-455-0x00000000041C0000-0x00000000041C2000-memory.dmpFilesize
8KB
-
memory/316-454-0x00000000041B0000-0x00000000041B2000-memory.dmpFilesize
8KB
-
memory/316-453-0x00000000041A0000-0x00000000041A2000-memory.dmpFilesize
8KB
-
memory/316-452-0x0000000004190000-0x0000000004192000-memory.dmpFilesize
8KB
-
memory/316-409-0x00000000039C0000-0x0000000003AC0000-memory.dmpFilesize
1024KB
-
memory/316-411-0x00000000039C0000-0x0000000003BC0000-memory.dmpFilesize
2.0MB
-
memory/316-413-0x00000000039C0000-0x0000000003AC0000-memory.dmpFilesize
1024KB
-
memory/316-414-0x00000000039C0000-0x0000000003BC0000-memory.dmpFilesize
2.0MB
-
memory/316-451-0x0000000004180000-0x0000000004182000-memory.dmpFilesize
8KB
-
memory/316-419-0x0000000002250000-0x0000000002252000-memory.dmpFilesize
8KB
-
memory/316-420-0x0000000002660000-0x0000000002662000-memory.dmpFilesize
8KB
-
memory/316-421-0x0000000002670000-0x0000000002672000-memory.dmpFilesize
8KB
-
memory/316-422-0x0000000002670000-0x0000000002672000-memory.dmpFilesize
8KB
-
memory/316-423-0x0000000002670000-0x0000000002672000-memory.dmpFilesize
8KB
-
memory/316-424-0x0000000003C10000-0x0000000003C12000-memory.dmpFilesize
8KB
-
memory/316-425-0x0000000003BF0000-0x0000000003BF2000-memory.dmpFilesize
8KB
-
memory/316-426-0x0000000002670000-0x0000000002672000-memory.dmpFilesize
8KB
-
memory/316-450-0x0000000002710000-0x0000000002712000-memory.dmpFilesize
8KB
-
memory/316-429-0x0000000003BE0000-0x0000000003BE2000-memory.dmpFilesize
8KB
-
memory/316-428-0x0000000002660000-0x0000000002662000-memory.dmpFilesize
8KB
-
memory/316-430-0x0000000003D90000-0x0000000003D92000-memory.dmpFilesize
8KB
-
memory/316-431-0x0000000004290000-0x0000000004292000-memory.dmpFilesize
8KB
-
memory/316-449-0x00000000026D0000-0x00000000026D2000-memory.dmpFilesize
8KB
-
memory/316-433-0x0000000004050000-0x0000000004052000-memory.dmpFilesize
8KB
-
memory/316-434-0x0000000003F20000-0x0000000003F22000-memory.dmpFilesize
8KB
-
memory/316-435-0x00000000042A0000-0x00000000042A2000-memory.dmpFilesize
8KB
-
memory/316-436-0x00000000042B0000-0x00000000042B2000-memory.dmpFilesize
8KB
-
memory/316-437-0x00000000042C0000-0x00000000042C2000-memory.dmpFilesize
8KB
-
memory/316-438-0x00000000042D0000-0x00000000042D2000-memory.dmpFilesize
8KB
-
memory/316-439-0x0000000004700000-0x0000000004702000-memory.dmpFilesize
8KB
-
memory/316-440-0x0000000004710000-0x0000000004712000-memory.dmpFilesize
8KB
-
memory/316-441-0x0000000005790000-0x0000000005792000-memory.dmpFilesize
8KB
-
memory/316-442-0x0000000004720000-0x0000000004722000-memory.dmpFilesize
8KB
-
memory/316-443-0x00000000055F0000-0x00000000055F2000-memory.dmpFilesize
8KB
-
memory/316-444-0x0000000004730000-0x0000000004732000-memory.dmpFilesize
8KB
-
memory/316-445-0x00000000055E0000-0x00000000055E2000-memory.dmpFilesize
8KB
-
memory/316-446-0x0000000004740000-0x0000000004742000-memory.dmpFilesize
8KB
-
memory/316-447-0x0000000004820000-0x0000000004822000-memory.dmpFilesize
8KB
-
memory/316-448-0x00000000047D0000-0x00000000047D2000-memory.dmpFilesize
8KB
-
memory/1080-16-0x0000000000000000-mapping.dmp
-
memory/1344-2-0x0000000000400000-0x0000000000585000-memory.dmpFilesize
1.5MB
-
memory/1344-3-0x0000000000417DF5-mapping.dmp
-
memory/1344-4-0x0000000000400000-0x0000000000585000-memory.dmpFilesize
1.5MB
-
memory/1480-406-0x0000000000000000-mapping.dmp
-
memory/1632-427-0x0000000000401130-mapping.dmp
-
memory/1632-7-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1632-8-0x0000000000401130-mapping.dmp
-
memory/1632-10-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2044-403-0x0000000000417DF5-mapping.dmp