Analysis
- max time kernel
149s - max time network
149s - platform
windows10_x64 - resource
win10v200430 - submitted
19/07/2020, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
skynet_0.4.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
skynet_0.4.vir.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target skynet_0.4.vir.exe
- Size 3.6MB
- Sample200719-fwck6e28f2
- SHA256 5978884a07ea7559941ec2a1ce86e08e4be36a9aae9d535f58021602b24cdaba
- MD5 a6cb3103fac2e6ad873ce6774e4ebddb
- SHA1 37c20c2ed8556b27217264dbaa7aa5a96894ca23
- SHA512 ef3f3fc6bd9764d4573250a43d2482483c5f2ddf4ba45218b4a2bb60b8d3a7992a36d7a9009db5d4818bb7601ea666963a16dafa56a09a47997d58627bda4058
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 2564 wrote to memory of 1344 2564 skynet_0.4.vir.exe 68 PID 1344 wrote to memory of 1472 1344 skynet_0.4.vir.exe 69 PID 1344 wrote to memory of 1472 1344 skynet_0.4.vir.exe 69 PID 1344 wrote to memory of 1540 1344 skynet_0.4.vir.exe 70 PID 1344 wrote to memory of 1540 1344 skynet_0.4.vir.exe 70 PID 1344 wrote to memory of 1560 1344 skynet_0.4.vir.exe 71 PID 1344 wrote to memory of 1560 1344 skynet_0.4.vir.exe 71 PID 1344 wrote to memory of 1828 1344 skynet_0.4.vir.exe 73 PID 1344 wrote to memory of 1828 1344 skynet_0.4.vir.exe 73 PID 1344 wrote to memory of 2316 1344 skynet_0.4.vir.exe 77 PID 1344 wrote to memory of 2316 1344 skynet_0.4.vir.exe 77 PID 1344 wrote to memory of 2548 1344 skynet_0.4.vir.exe 78 PID 1344 wrote to memory of 2548 1344 skynet_0.4.vir.exe 78 PID 1344 wrote to memory of 2548 1344 skynet_0.4.vir.exe 78 PID 1344 wrote to memory of 2548 1344 skynet_0.4.vir.exe 78 PID 1344 wrote to memory of 2548 1344 skynet_0.4.vir.exe 78 PID 1344 wrote to memory of 2548 1344 skynet_0.4.vir.exe 78 PID 1344 wrote to memory of 2548 1344 skynet_0.4.vir.exe 78 PID 1344 wrote to memory of 2548 1344 skynet_0.4.vir.exe 78 PID 1344 wrote to memory of 2548 1344 skynet_0.4.vir.exe 78 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2548 wrote to memory of 2764 2548 svchost.exe 79 PID 2764 wrote to memory of 3376 2764 svchost.exe 80 PID 2764 wrote to memory of 3376 2764 svchost.exe 80 PID 2764 wrote to memory of 3376 2764 svchost.exe 80 PID 2764 wrote to memory of 3376 2764 svchost.exe 80 PID 2764 wrote to memory of 3376 2764 svchost.exe 80 PID 2764 wrote to memory of 3376 2764 svchost.exe 80 PID 2764 wrote to memory of 3376 2764 svchost.exe 80 PID 2764 wrote to memory of 3376 2764 svchost.exe 80 PID 2764 wrote to memory of 3860 2764 svchost.exe 81 PID 2764 wrote to memory of 3860 2764 svchost.exe 81 PID 2764 wrote to memory of 4064 2764 svchost.exe 82 PID 2764 wrote to memory of 4064 2764 svchost.exe 82 PID 2764 wrote to memory of 4064 2764 svchost.exe 82 PID 2764 wrote to memory of 4064 2764 svchost.exe 82 PID 2764 wrote to memory of 4064 2764 svchost.exe 82 PID 2764 wrote to memory of 4064 2764 svchost.exe 82 PID 2764 wrote to memory of 4064 2764 svchost.exe 82 PID 2764 wrote to memory of 4064 2764 svchost.exe 82 - Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2564 set thread context of 1344 2564 skynet_0.4.vir.exe 68 PID 1344 set thread context of 2548 1344 skynet_0.4.vir.exe 78 PID 2548 set thread context of 2764 2548 svchost.exe 79 PID 2764 set thread context of 3376 2764 svchost.exe 80 PID 2764 set thread context of 4064 2764 svchost.exe 82 - Suspicious behavior: EnumeratesProcesses 156 IoCs
pid Process 4064 svchost.exe 4064 svchost.exe 2764 svchost.exe 2764 svchost.exe 4064 svchost.exe 4064 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe -
resource yara_rule behavioral2/memory/4064-12-0x0000000000400000-0x0000000000742000-memory.dmp upx behavioral2/memory/4064-14-0x0000000000400000-0x0000000000742000-memory.dmp upx behavioral2/memory/4064-15-0x0000000000400000-0x0000000000742000-memory.dmp upx - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 checkip.dyndns.org
Processes
-
C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1344 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"3⤵PID:1472
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"3⤵PID:1540
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"3⤵PID:1560
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"3⤵PID:1828
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"3⤵PID:2316
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2548 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe" "ext" "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2764 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe" ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.4.vir.exe"5⤵PID:3376
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"5⤵PID:3860
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Program Files\Internet Explorer\iexplore.exe" --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4064
-
-
-
-