Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10 -
submitted
19-07-2020 19:52
Static task
static1
Behavioral task
behavioral1
Sample
tasks_197.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tasks_197.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
tasks_197.vir.exe
-
Size
226KB
-
MD5
8ee9fb84989bd2b845327e7ec0f8947e
-
SHA1
2c434799deba0dce282a3c9eb700d441488cca22
-
SHA256
dd7e225d33efa7642ebf94d87194fee6d9bafa89cd8ad6b05a5e14ecf1094190
-
SHA512
6ca3ba37f26978ab1d8e00137623ba9675194a60d61c472d985fef7c154abb117f5957a36d4bf04f3940413985b6b9e952e7f3e945365b1a039aae3e2abe644b
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
winsec32.exeexqudii.exeexqudii.exepid process 3956 winsec32.exe 1936 exqudii.exe 2684 exqudii.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
tasks_197.vir.exeexqudii.exeexqudii.exedescription pid process target process PID 3852 wrote to memory of 1936 3852 tasks_197.vir.exe exqudii.exe PID 3852 wrote to memory of 1936 3852 tasks_197.vir.exe exqudii.exe PID 3852 wrote to memory of 1936 3852 tasks_197.vir.exe exqudii.exe PID 3852 wrote to memory of 772 3852 tasks_197.vir.exe cmd.exe PID 3852 wrote to memory of 772 3852 tasks_197.vir.exe cmd.exe PID 3852 wrote to memory of 772 3852 tasks_197.vir.exe cmd.exe PID 1936 wrote to memory of 2972 1936 exqudii.exe Explorer.EXE PID 1936 wrote to memory of 2684 1936 exqudii.exe exqudii.exe PID 1936 wrote to memory of 2684 1936 exqudii.exe exqudii.exe PID 1936 wrote to memory of 2684 1936 exqudii.exe exqudii.exe PID 1936 wrote to memory of 2972 1936 exqudii.exe Explorer.EXE PID 1936 wrote to memory of 2972 1936 exqudii.exe Explorer.EXE PID 1936 wrote to memory of 2972 1936 exqudii.exe Explorer.EXE PID 1936 wrote to memory of 2972 1936 exqudii.exe Explorer.EXE PID 1936 wrote to memory of 2972 1936 exqudii.exe Explorer.EXE PID 1936 wrote to memory of 2972 1936 exqudii.exe Explorer.EXE PID 2684 wrote to memory of 3940 2684 exqudii.exe ctfmon.exe PID 2684 wrote to memory of 3940 2684 exqudii.exe ctfmon.exe PID 2684 wrote to memory of 3940 2684 exqudii.exe ctfmon.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE Token: SeShutdownPrivilege 2972 Explorer.EXE Token: SeCreatePagefilePrivilege 2972 Explorer.EXE -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Explorer.EXEpid process 2972 Explorer.EXE -
Drops file in System32 directory 2 IoCs
Processes:
tasks_197.vir.exedescription ioc process File created C:\Windows\SysWOW64\winsec32.exe tasks_197.vir.exe File opened for modification C:\Windows\SysWOW64\winsec32.exe tasks_197.vir.exe -
Suspicious behavior: EnumeratesProcesses 104 IoCs
Processes:
exqudii.exeexqudii.exepid process 1936 exqudii.exe 1936 exqudii.exe 1936 exqudii.exe 1936 exqudii.exe 1936 exqudii.exe 1936 exqudii.exe 1936 exqudii.exe 1936 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe 2684 exqudii.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Explorer.EXEpid process 2972 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
exqudii.exepid process 2684 exqudii.exe 2684 exqudii.exe -
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
exqudii.exewinsec32.exeExplorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run exqudii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Opasqaibudygl = "C:\\Users\\Admin\\AppData\\Roaming\\Doosagac\\exqudii.exe" exqudii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Opasqaibudygl = "\"C:\\Users\\Admin\\AppData\\Roaming\\Doosagac\\exqudii.exe\"" winsec32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run exqudii.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opasqaibudygl = "\"C:\\Users\\Admin\\AppData\\Roaming\\Doosagac\\exqudii.exe\"" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Opasqaibudygl = "C:\\Users\\Admin\\AppData\\Roaming\\Doosagac\\exqudii.exe" exqudii.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run winsec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opasqaibudygl = "\"C:\\Users\\Admin\\AppData\\Roaming\\Doosagac\\exqudii.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
tasks_197.vir.exedescription ioc process File created C:\Windows\Tasks\Security Center Update - 1920796202.job tasks_197.vir.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\tasks_197.vir.exe"C:\Users\Admin\AppData\Local\Temp\tasks_197.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Roaming\Doosagac\exqudii.exe"C:\Users\Admin\AppData\Roaming\Doosagac\exqudii.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Doosagac\exqudii.exe"C:\Users\Admin\AppData\Roaming\Doosagac\exqudii.exe" -child4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ctfmon.exectfmon.exe5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0b7fc48c.bat"3⤵
-
C:\Windows\SysWOW64\winsec32.exe"C:\Windows\SysWOW64\winsec32.exe" -service "C:\Users\Admin\AppData\Roaming\Doosagac\exqudii.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\M2P8J76T.cookie
-
C:\Users\Admin\AppData\Local\Temp\tmp0b7fc48c.bat
-
C:\Users\Admin\AppData\Roaming\Doosagac\exqudii.exe
-
C:\Users\Admin\AppData\Roaming\Doosagac\exqudii.exe
-
C:\Users\Admin\AppData\Roaming\Doosagac\exqudii.exe
-
C:\Windows\SysWOW64\winsec32.exe
-
C:\Windows\SysWOW64\winsec32.exe
-
memory/772-5-0x0000000000000000-mapping.dmp
-
memory/1936-3-0x0000000000000000-mapping.dmp
-
memory/2684-7-0x0000000000000000-mapping.dmp
-
memory/2972-6-0x0000000001410000-0x0000000001411000-memory.dmpFilesize
4KB
-
memory/3940-15-0x0000000000000000-mapping.dmp