Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:29
Static task
static1
Behavioral task
behavioral1
Sample
uncategorized_5.0.0.1.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
uncategorized_5.0.0.1.vir.exe
Resource
win10v200430
General
-
Target
uncategorized_5.0.0.1.vir.exe
-
Size
138KB
-
MD5
5463b8e1d5c3947aa83099c143a7bf08
-
SHA1
7b2ef18142507718801e41ac105b7db1cbdbe5b5
-
SHA256
f473938086334f7e6877e53b350339f11cfcc87ba10ec04a17bccfdf4d47a301
-
SHA512
6df5da7a0675de3bce1671b6e57b99e44cd66e41a896ed85dcbc2848dcda77810f4e9be5f25864db6e07d3315ac7cb17b8d317a101b1ba5d87781986df9d34dc
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
ukaqv.exepid process 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe 1488 ukaqv.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 548 WinMail.exe -
Loads dropped DLL 2 IoCs
Processes:
uncategorized_5.0.0.1.vir.exepid process 1456 uncategorized_5.0.0.1.vir.exe 1456 uncategorized_5.0.0.1.vir.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
uncategorized_5.0.0.1.vir.exeukaqv.exedescription pid process target process PID 1456 wrote to memory of 1488 1456 uncategorized_5.0.0.1.vir.exe ukaqv.exe PID 1456 wrote to memory of 1488 1456 uncategorized_5.0.0.1.vir.exe ukaqv.exe PID 1456 wrote to memory of 1488 1456 uncategorized_5.0.0.1.vir.exe ukaqv.exe PID 1456 wrote to memory of 1488 1456 uncategorized_5.0.0.1.vir.exe ukaqv.exe PID 1488 wrote to memory of 1176 1488 ukaqv.exe taskhost.exe PID 1488 wrote to memory of 1176 1488 ukaqv.exe taskhost.exe PID 1488 wrote to memory of 1176 1488 ukaqv.exe taskhost.exe PID 1488 wrote to memory of 1176 1488 ukaqv.exe taskhost.exe PID 1488 wrote to memory of 1176 1488 ukaqv.exe taskhost.exe PID 1488 wrote to memory of 1256 1488 ukaqv.exe Dwm.exe PID 1488 wrote to memory of 1256 1488 ukaqv.exe Dwm.exe PID 1488 wrote to memory of 1256 1488 ukaqv.exe Dwm.exe PID 1488 wrote to memory of 1256 1488 ukaqv.exe Dwm.exe PID 1488 wrote to memory of 1256 1488 ukaqv.exe Dwm.exe PID 1488 wrote to memory of 1320 1488 ukaqv.exe Explorer.EXE PID 1488 wrote to memory of 1320 1488 ukaqv.exe Explorer.EXE PID 1488 wrote to memory of 1320 1488 ukaqv.exe Explorer.EXE PID 1488 wrote to memory of 1320 1488 ukaqv.exe Explorer.EXE PID 1488 wrote to memory of 1320 1488 ukaqv.exe Explorer.EXE PID 1488 wrote to memory of 1456 1488 ukaqv.exe uncategorized_5.0.0.1.vir.exe PID 1488 wrote to memory of 1456 1488 ukaqv.exe uncategorized_5.0.0.1.vir.exe PID 1488 wrote to memory of 1456 1488 ukaqv.exe uncategorized_5.0.0.1.vir.exe PID 1488 wrote to memory of 1456 1488 ukaqv.exe uncategorized_5.0.0.1.vir.exe PID 1488 wrote to memory of 1456 1488 ukaqv.exe uncategorized_5.0.0.1.vir.exe PID 1456 wrote to memory of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe PID 1456 wrote to memory of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe PID 1456 wrote to memory of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe PID 1456 wrote to memory of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe PID 1456 wrote to memory of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe PID 1456 wrote to memory of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe PID 1456 wrote to memory of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe PID 1456 wrote to memory of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe PID 1456 wrote to memory of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe PID 1488 wrote to memory of 1884 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1884 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1884 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1884 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1884 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1392 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1392 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1392 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1392 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1392 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1468 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1468 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1468 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1468 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1468 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1556 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1556 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1556 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1556 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1556 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1524 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1524 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1524 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1524 1488 ukaqv.exe DllHost.exe PID 1488 wrote to memory of 1524 1488 ukaqv.exe DllHost.exe -
Executes dropped EXE 1 IoCs
Processes:
ukaqv.exepid process 1488 ukaqv.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 548 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 548 WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uncategorized_5.0.0.1.vir.exedescription pid process target process PID 1456 set thread context of 2000 1456 uncategorized_5.0.0.1.vir.exe cmd.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2000 cmd.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\230F61BA-00000001.eml:OECustomProperty WinMail.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
uncategorized_5.0.0.1.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1456 uncategorized_5.0.0.1.vir.exe Token: SeSecurityPrivilege 1456 uncategorized_5.0.0.1.vir.exe Token: SeSecurityPrivilege 1456 uncategorized_5.0.0.1.vir.exe Token: SeManageVolumePrivilege 548 WinMail.exe -
Processes:
uncategorized_5.0.0.1.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy uncategorized_5.0.0.1.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" uncategorized_5.0.0.1.vir.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ukaqv.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run ukaqv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{50A34787-F466-ADF7-E19C-5E5FD61CFB24} = "C:\\Users\\Admin\\AppData\\Roaming\\Atucb\\ukaqv.exe" ukaqv.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\uncategorized_5.0.0.1.vir.exe"C:\Users\Admin\AppData\Local\Temp\uncategorized_5.0.0.1.vir.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Roaming\Atucb\ukaqv.exe"C:\Users\Admin\AppData\Roaming\Atucb\ukaqv.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5806563f.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5806563f.bat
-
C:\Users\Admin\AppData\Roaming\Atucb\ukaqv.exe
-
C:\Users\Admin\AppData\Roaming\Atucb\ukaqv.exe
-
C:\Users\Admin\AppData\Roaming\Tyxu\eqla.hab
-
\Users\Admin\AppData\Roaming\Atucb\ukaqv.exe
-
\Users\Admin\AppData\Roaming\Atucb\ukaqv.exe
-
memory/548-5-0x0000000003880000-0x0000000003980000-memory.dmpFilesize
1024KB
-
memory/548-7-0x0000000003880000-0x0000000003A80000-memory.dmpFilesize
2.0MB
-
memory/548-9-0x0000000003880000-0x0000000003980000-memory.dmpFilesize
1024KB
-
memory/548-10-0x0000000003880000-0x0000000003A80000-memory.dmpFilesize
2.0MB
-
memory/548-11-0x0000000003980000-0x0000000003A80000-memory.dmpFilesize
1024KB
-
memory/548-15-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/548-16-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/548-17-0x0000000003AD0000-0x0000000003AD2000-memory.dmpFilesize
8KB
-
memory/548-18-0x0000000003DE0000-0x0000000003DE2000-memory.dmpFilesize
8KB
-
memory/548-19-0x0000000003FC0000-0x0000000003FC2000-memory.dmpFilesize
8KB
-
memory/548-20-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/548-21-0x0000000003FA0000-0x0000000003FA2000-memory.dmpFilesize
8KB
-
memory/548-22-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/548-23-0x0000000003E20000-0x0000000003E22000-memory.dmpFilesize
8KB
-
memory/548-24-0x00000000041C0000-0x00000000041C2000-memory.dmpFilesize
8KB
-
memory/548-25-0x0000000003DE0000-0x0000000003DE2000-memory.dmpFilesize
8KB
-
memory/548-26-0x0000000003FD0000-0x0000000003FD2000-memory.dmpFilesize
8KB
-
memory/548-27-0x0000000003D10000-0x0000000003D12000-memory.dmpFilesize
8KB
-
memory/548-28-0x0000000003E70000-0x0000000003E72000-memory.dmpFilesize
8KB
-
memory/548-29-0x00000000045A0000-0x00000000045A2000-memory.dmpFilesize
8KB
-
memory/548-30-0x0000000004630000-0x0000000004632000-memory.dmpFilesize
8KB
-
memory/548-31-0x0000000004640000-0x0000000004642000-memory.dmpFilesize
8KB
-
memory/548-32-0x0000000004660000-0x0000000004662000-memory.dmpFilesize
8KB
-
memory/548-33-0x0000000004680000-0x0000000004682000-memory.dmpFilesize
8KB
-
memory/548-34-0x0000000004690000-0x0000000004692000-memory.dmpFilesize
8KB
-
memory/548-35-0x00000000046A0000-0x00000000046A2000-memory.dmpFilesize
8KB
-
memory/548-36-0x0000000004B80000-0x0000000004B82000-memory.dmpFilesize
8KB
-
memory/548-37-0x0000000004B90000-0x0000000004B92000-memory.dmpFilesize
8KB
-
memory/548-38-0x0000000004C80000-0x0000000004C82000-memory.dmpFilesize
8KB
-
memory/548-39-0x0000000004C90000-0x0000000004C92000-memory.dmpFilesize
8KB
-
memory/548-40-0x0000000004CA0000-0x0000000004CA2000-memory.dmpFilesize
8KB
-
memory/548-41-0x0000000004D30000-0x0000000004D32000-memory.dmpFilesize
8KB
-
memory/548-42-0x0000000003D20000-0x0000000003D22000-memory.dmpFilesize
8KB
-
memory/548-43-0x0000000003DF0000-0x0000000003DF2000-memory.dmpFilesize
8KB
-
memory/548-44-0x0000000004600000-0x0000000004602000-memory.dmpFilesize
8KB
-
memory/548-45-0x00000000045F0000-0x00000000045F2000-memory.dmpFilesize
8KB
-
memory/548-47-0x00000000045D0000-0x00000000045D2000-memory.dmpFilesize
8KB
-
memory/548-46-0x00000000045E0000-0x00000000045E2000-memory.dmpFilesize
8KB
-
memory/548-48-0x00000000045C0000-0x00000000045C2000-memory.dmpFilesize
8KB
-
memory/548-49-0x0000000003880000-0x0000000003980000-memory.dmpFilesize
1024KB
-
memory/548-51-0x0000000002480000-0x0000000002490000-memory.dmpFilesize
64KB
-
memory/548-57-0x0000000001F10000-0x0000000001F20000-memory.dmpFilesize
64KB
-
memory/1488-2-0x0000000000000000-mapping.dmp
-
memory/2000-63-0x0000000000150000-0x0000000000177000-memory.dmpFilesize
156KB
-
memory/2000-65-0x000000000015AB82-mapping.dmp