Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:46
Static task
static1
Behavioral task
behavioral1
Sample
uncategorized_1.3.9.5.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
uncategorized_1.3.9.5.vir.exe
Resource
win10v200430
General
-
Target
uncategorized_1.3.9.5.vir.exe
-
Size
224KB
-
MD5
6d7e1be96ee8807fa1463389a4243aef
-
SHA1
b392648e0e1102ef989d63cbc9e489e8ea0aa324
-
SHA256
0d812586b239b0ce1c4f3f9347386c75e70ab098659c019e100160078b821aa5
-
SHA512
c18c3369fadee7f04f09092cb3402463ec7c6491b97e3730ee5e539748d3f89953126369165206336a48c22b6174e11a583aaf3dd8e8869ecd01f346b0b7ffe7
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 74 IoCs
Processes:
uncategorized_1.3.9.5.vir.exeuncategorized_1.3.9.5.vir.exeyfasu.exeyfasu.exedescription pid process target process PID 1108 wrote to memory of 1280 1108 uncategorized_1.3.9.5.vir.exe iexplore.exe PID 1108 wrote to memory of 1280 1108 uncategorized_1.3.9.5.vir.exe iexplore.exe PID 1108 wrote to memory of 1280 1108 uncategorized_1.3.9.5.vir.exe iexplore.exe PID 1108 wrote to memory of 1280 1108 uncategorized_1.3.9.5.vir.exe iexplore.exe PID 1108 wrote to memory of 1280 1108 uncategorized_1.3.9.5.vir.exe iexplore.exe PID 1108 wrote to memory of 1280 1108 uncategorized_1.3.9.5.vir.exe iexplore.exe PID 1108 wrote to memory of 1280 1108 uncategorized_1.3.9.5.vir.exe iexplore.exe PID 1108 wrote to memory of 1280 1108 uncategorized_1.3.9.5.vir.exe iexplore.exe PID 1108 wrote to memory of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 1108 wrote to memory of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 1108 wrote to memory of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 1108 wrote to memory of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 1108 wrote to memory of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 1108 wrote to memory of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 1108 wrote to memory of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 1108 wrote to memory of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 1108 wrote to memory of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 1432 wrote to memory of 912 1432 uncategorized_1.3.9.5.vir.exe yfasu.exe PID 1432 wrote to memory of 912 1432 uncategorized_1.3.9.5.vir.exe yfasu.exe PID 1432 wrote to memory of 912 1432 uncategorized_1.3.9.5.vir.exe yfasu.exe PID 1432 wrote to memory of 912 1432 uncategorized_1.3.9.5.vir.exe yfasu.exe PID 912 wrote to memory of 744 912 yfasu.exe yfasu.exe PID 912 wrote to memory of 744 912 yfasu.exe yfasu.exe PID 912 wrote to memory of 744 912 yfasu.exe yfasu.exe PID 912 wrote to memory of 744 912 yfasu.exe yfasu.exe PID 912 wrote to memory of 744 912 yfasu.exe yfasu.exe PID 912 wrote to memory of 744 912 yfasu.exe yfasu.exe PID 912 wrote to memory of 744 912 yfasu.exe yfasu.exe PID 912 wrote to memory of 744 912 yfasu.exe yfasu.exe PID 912 wrote to memory of 744 912 yfasu.exe yfasu.exe PID 1432 wrote to memory of 1656 1432 uncategorized_1.3.9.5.vir.exe cmd.exe PID 1432 wrote to memory of 1656 1432 uncategorized_1.3.9.5.vir.exe cmd.exe PID 1432 wrote to memory of 1656 1432 uncategorized_1.3.9.5.vir.exe cmd.exe PID 1432 wrote to memory of 1656 1432 uncategorized_1.3.9.5.vir.exe cmd.exe PID 744 wrote to memory of 1140 744 yfasu.exe taskhost.exe PID 744 wrote to memory of 1140 744 yfasu.exe taskhost.exe PID 744 wrote to memory of 1140 744 yfasu.exe taskhost.exe PID 744 wrote to memory of 1140 744 yfasu.exe taskhost.exe PID 744 wrote to memory of 1140 744 yfasu.exe taskhost.exe PID 744 wrote to memory of 1236 744 yfasu.exe Dwm.exe PID 744 wrote to memory of 1236 744 yfasu.exe Dwm.exe PID 744 wrote to memory of 1236 744 yfasu.exe Dwm.exe PID 744 wrote to memory of 1236 744 yfasu.exe Dwm.exe PID 744 wrote to memory of 1236 744 yfasu.exe Dwm.exe PID 744 wrote to memory of 1284 744 yfasu.exe Explorer.EXE PID 744 wrote to memory of 1284 744 yfasu.exe Explorer.EXE PID 744 wrote to memory of 1284 744 yfasu.exe Explorer.EXE PID 744 wrote to memory of 1284 744 yfasu.exe Explorer.EXE PID 744 wrote to memory of 1284 744 yfasu.exe Explorer.EXE PID 744 wrote to memory of 1280 744 yfasu.exe iexplore.exe PID 744 wrote to memory of 1280 744 yfasu.exe iexplore.exe PID 744 wrote to memory of 1280 744 yfasu.exe iexplore.exe PID 744 wrote to memory of 1280 744 yfasu.exe iexplore.exe PID 744 wrote to memory of 1280 744 yfasu.exe iexplore.exe PID 744 wrote to memory of 1448 744 yfasu.exe DllHost.exe PID 744 wrote to memory of 1448 744 yfasu.exe DllHost.exe PID 744 wrote to memory of 1448 744 yfasu.exe DllHost.exe PID 744 wrote to memory of 1448 744 yfasu.exe DllHost.exe PID 744 wrote to memory of 1448 744 yfasu.exe DllHost.exe PID 744 wrote to memory of 1312 744 yfasu.exe DllHost.exe PID 744 wrote to memory of 1312 744 yfasu.exe DllHost.exe PID 744 wrote to memory of 1312 744 yfasu.exe DllHost.exe PID 744 wrote to memory of 1312 744 yfasu.exe DllHost.exe PID 744 wrote to memory of 1312 744 yfasu.exe DllHost.exe -
Loads dropped DLL 2 IoCs
Processes:
uncategorized_1.3.9.5.vir.exepid process 1432 uncategorized_1.3.9.5.vir.exe 1432 uncategorized_1.3.9.5.vir.exe -
Executes dropped EXE 2 IoCs
Processes:
yfasu.exeyfasu.exepid process 912 yfasu.exe 744 yfasu.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1372 WinMail.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
yfasu.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run yfasu.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{C9B9A6C8-9AB2-8B50-FBB1-A8107B687D89} = "C:\\Users\\Admin\\AppData\\Roaming\\Oladzy\\yfasu.exe" yfasu.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
uncategorized_1.3.9.5.vir.exeyfasu.exeyfasu.exepid process 1108 uncategorized_1.3.9.5.vir.exe 1108 uncategorized_1.3.9.5.vir.exe 1108 uncategorized_1.3.9.5.vir.exe 912 yfasu.exe 912 yfasu.exe 912 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe 744 yfasu.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\0CD231D9-00000001.eml:OECustomProperty WinMail.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
uncategorized_1.3.9.5.vir.exeyfasu.exeWinMail.exepid process 1108 uncategorized_1.3.9.5.vir.exe 1108 uncategorized_1.3.9.5.vir.exe 912 yfasu.exe 912 yfasu.exe 1372 WinMail.exe -
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" iexplore.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
uncategorized_1.3.9.5.vir.exeyfasu.exedescription pid process target process PID 1108 set thread context of 1280 1108 uncategorized_1.3.9.5.vir.exe iexplore.exe PID 1108 set thread context of 1432 1108 uncategorized_1.3.9.5.vir.exe uncategorized_1.3.9.5.vir.exe PID 912 set thread context of 744 912 yfasu.exe yfasu.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
uncategorized_1.3.9.5.vir.exeiexplore.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1432 uncategorized_1.3.9.5.vir.exe Token: SeSecurityPrivilege 1280 iexplore.exe Token: SeSecurityPrivilege 1280 iexplore.exe Token: SeManageVolumePrivilege 1372 WinMail.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1656 cmd.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1372 WinMail.exe -
Processes:
resource yara_rule behavioral1/memory/1280-3-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1280-5-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1280-7-0x0000000000400000-0x0000000000414000-memory.dmp upx
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\uncategorized_1.3.9.5.vir.exe"C:\Users\Admin\AppData\Local\Temp\uncategorized_1.3.9.5.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\uncategorized_1.3.9.5.vir.exeC:\Users\Admin\AppData\Local\Temp\uncategorized_1.3.9.5.vir.exe3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Oladzy\yfasu.exe"C:\Users\Admin\AppData\Roaming\Oladzy\yfasu.exe"4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Oladzy\yfasu.exeC:\Users\Admin\AppData\Roaming\Oladzy\yfasu.exe5⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3758a6b5.bat"4⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of FindShellTrayWindow
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3758a6b5.bat
-
C:\Users\Admin\AppData\Roaming\Epodz\zaim.umu
-
C:\Users\Admin\AppData\Roaming\Oladzy\yfasu.exe
-
C:\Users\Admin\AppData\Roaming\Oladzy\yfasu.exe
-
C:\Users\Admin\AppData\Roaming\Oladzy\yfasu.exe
-
\Users\Admin\AppData\Roaming\Oladzy\yfasu.exe
-
\Users\Admin\AppData\Roaming\Oladzy\yfasu.exe
-
memory/744-19-0x000000000041093D-mapping.dmp
-
memory/912-13-0x0000000000000000-mapping.dmp
-
memory/912-16-0x0000000003730000-0x0000000003741000-memory.dmpFilesize
68KB
-
memory/1108-6-0x00000000037A0000-0x00000000037B1000-memory.dmpFilesize
68KB
-
memory/1108-0-0x00000000037A0000-0x00000000037B1000-memory.dmpFilesize
68KB
-
memory/1108-2-0x00000000037A0000-0x00000000037B1000-memory.dmpFilesize
68KB
-
memory/1108-1-0x00000000037A0000-0x00000000037B1000-memory.dmpFilesize
68KB
-
memory/1280-7-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1280-5-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1280-4-0x0000000000412110-mapping.dmp
-
memory/1280-23-0x0000000000412110-mapping.dmp
-
memory/1280-3-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1372-40-0x0000000003AD0000-0x0000000003AD2000-memory.dmpFilesize
8KB
-
memory/1372-50-0x0000000003E60000-0x0000000003E62000-memory.dmpFilesize
8KB
-
memory/1372-78-0x00000000020D0000-0x00000000020E0000-memory.dmpFilesize
64KB
-
memory/1372-25-0x0000000003880000-0x0000000003980000-memory.dmpFilesize
1024KB
-
memory/1372-27-0x0000000003880000-0x0000000003A80000-memory.dmpFilesize
2.0MB
-
memory/1372-29-0x0000000003880000-0x0000000003980000-memory.dmpFilesize
1024KB
-
memory/1372-30-0x0000000003880000-0x0000000003A80000-memory.dmpFilesize
2.0MB
-
memory/1372-31-0x0000000003980000-0x0000000003A80000-memory.dmpFilesize
1024KB
-
memory/1372-35-0x0000000003AE0000-0x0000000003AE2000-memory.dmpFilesize
8KB
-
memory/1372-36-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/1372-37-0x0000000003AD0000-0x0000000003AD2000-memory.dmpFilesize
8KB
-
memory/1372-38-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/1372-39-0x0000000003D50000-0x0000000003D52000-memory.dmpFilesize
8KB
-
memory/1372-72-0x0000000002130000-0x0000000002140000-memory.dmpFilesize
64KB
-
memory/1372-41-0x0000000003D50000-0x0000000003D52000-memory.dmpFilesize
8KB
-
memory/1372-42-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/1372-43-0x0000000003BC0000-0x0000000003BC2000-memory.dmpFilesize
8KB
-
memory/1372-44-0x0000000003BE0000-0x0000000003BE2000-memory.dmpFilesize
8KB
-
memory/1372-45-0x0000000003B60000-0x0000000003B62000-memory.dmpFilesize
8KB
-
memory/1372-46-0x0000000003BB0000-0x0000000003BB2000-memory.dmpFilesize
8KB
-
memory/1372-47-0x0000000003EA0000-0x0000000003EA2000-memory.dmpFilesize
8KB
-
memory/1372-48-0x0000000004120000-0x0000000004122000-memory.dmpFilesize
8KB
-
memory/1372-49-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/1372-70-0x0000000003880000-0x0000000003980000-memory.dmpFilesize
1024KB
-
memory/1372-51-0x0000000004100000-0x0000000004102000-memory.dmpFilesize
8KB
-
memory/1372-52-0x0000000004630000-0x0000000004632000-memory.dmpFilesize
8KB
-
memory/1372-53-0x0000000004640000-0x0000000004642000-memory.dmpFilesize
8KB
-
memory/1372-54-0x0000000003BA0000-0x0000000003BA2000-memory.dmpFilesize
8KB
-
memory/1372-55-0x0000000004650000-0x0000000004652000-memory.dmpFilesize
8KB
-
memory/1372-56-0x0000000004670000-0x0000000004672000-memory.dmpFilesize
8KB
-
memory/1372-57-0x0000000003B50000-0x0000000003B52000-memory.dmpFilesize
8KB
-
memory/1372-58-0x0000000004690000-0x0000000004692000-memory.dmpFilesize
8KB
-
memory/1372-59-0x0000000003BE0000-0x0000000003BE2000-memory.dmpFilesize
8KB
-
memory/1372-60-0x0000000004CE0000-0x0000000004CE2000-memory.dmpFilesize
8KB
-
memory/1372-61-0x0000000004CD0000-0x0000000004CD2000-memory.dmpFilesize
8KB
-
memory/1372-62-0x0000000004CC0000-0x0000000004CC2000-memory.dmpFilesize
8KB
-
memory/1372-63-0x0000000004CB0000-0x0000000004CB2000-memory.dmpFilesize
8KB
-
memory/1372-64-0x0000000004250000-0x0000000004252000-memory.dmpFilesize
8KB
-
memory/1372-65-0x0000000004750000-0x0000000004752000-memory.dmpFilesize
8KB
-
memory/1372-66-0x0000000004740000-0x0000000004742000-memory.dmpFilesize
8KB
-
memory/1372-67-0x00000000046B0000-0x00000000046B2000-memory.dmpFilesize
8KB
-
memory/1372-68-0x00000000046A0000-0x00000000046A2000-memory.dmpFilesize
8KB
-
memory/1372-69-0x0000000004260000-0x0000000004262000-memory.dmpFilesize
8KB
-
memory/1432-9-0x000000000041093D-mapping.dmp
-
memory/1432-10-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1432-8-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1656-22-0x0000000000000000-mapping.dmp