Analysis
-
max time kernel
151s -
max time network
119s -
platform
windows7_x64 -
resource
win7 -
submitted
19-07-2020 19:22
Static task
static1
Behavioral task
behavioral1
Sample
uncategorized_3.1.0.8.vir.exe
Resource
win7
Behavioral task
behavioral2
Sample
uncategorized_3.1.0.8.vir.exe
Resource
win10v200430
General
-
Target
uncategorized_3.1.0.8.vir.exe
-
Size
138KB
-
MD5
32d41459d463da10d92c1e14c487cc0c
-
SHA1
d6fd3acae67cd9875d339fe649bf237a7e0ae316
-
SHA256
d1c4be3772ebe6d26f06e3e38ae667c3236e1f13658e652eed0aa14dac5f45f0
-
SHA512
23f9554aa4d75be4a909fc1c35798cffe2e22503e222815cf846399bf33fba16c4856953ebf28f9f7dfb688a67e1dd498114f4fa409dba5fad4891e5bcaf178e
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
uncategorized_3.1.0.8.vir.exelote.exedescription pid process target process PID 900 wrote to memory of 844 900 uncategorized_3.1.0.8.vir.exe lote.exe PID 900 wrote to memory of 844 900 uncategorized_3.1.0.8.vir.exe lote.exe PID 900 wrote to memory of 844 900 uncategorized_3.1.0.8.vir.exe lote.exe PID 900 wrote to memory of 844 900 uncategorized_3.1.0.8.vir.exe lote.exe PID 844 wrote to memory of 1172 844 lote.exe taskhost.exe PID 844 wrote to memory of 1172 844 lote.exe taskhost.exe PID 844 wrote to memory of 1172 844 lote.exe taskhost.exe PID 844 wrote to memory of 1172 844 lote.exe taskhost.exe PID 844 wrote to memory of 1172 844 lote.exe taskhost.exe PID 844 wrote to memory of 1272 844 lote.exe Dwm.exe PID 844 wrote to memory of 1272 844 lote.exe Dwm.exe PID 844 wrote to memory of 1272 844 lote.exe Dwm.exe PID 844 wrote to memory of 1272 844 lote.exe Dwm.exe PID 844 wrote to memory of 1272 844 lote.exe Dwm.exe PID 844 wrote to memory of 1336 844 lote.exe Explorer.EXE PID 844 wrote to memory of 1336 844 lote.exe Explorer.EXE PID 844 wrote to memory of 1336 844 lote.exe Explorer.EXE PID 844 wrote to memory of 1336 844 lote.exe Explorer.EXE PID 844 wrote to memory of 1336 844 lote.exe Explorer.EXE PID 844 wrote to memory of 900 844 lote.exe uncategorized_3.1.0.8.vir.exe PID 844 wrote to memory of 900 844 lote.exe uncategorized_3.1.0.8.vir.exe PID 844 wrote to memory of 900 844 lote.exe uncategorized_3.1.0.8.vir.exe PID 844 wrote to memory of 900 844 lote.exe uncategorized_3.1.0.8.vir.exe PID 844 wrote to memory of 900 844 lote.exe uncategorized_3.1.0.8.vir.exe PID 900 wrote to memory of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe PID 900 wrote to memory of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe PID 900 wrote to memory of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe PID 900 wrote to memory of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe PID 900 wrote to memory of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe PID 900 wrote to memory of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe PID 900 wrote to memory of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe PID 900 wrote to memory of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe PID 900 wrote to memory of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe PID 844 wrote to memory of 544 844 lote.exe DllHost.exe PID 844 wrote to memory of 544 844 lote.exe DllHost.exe PID 844 wrote to memory of 544 844 lote.exe DllHost.exe PID 844 wrote to memory of 544 844 lote.exe DllHost.exe PID 844 wrote to memory of 544 844 lote.exe DllHost.exe PID 844 wrote to memory of 2024 844 lote.exe DllHost.exe PID 844 wrote to memory of 2024 844 lote.exe DllHost.exe PID 844 wrote to memory of 2024 844 lote.exe DllHost.exe PID 844 wrote to memory of 2024 844 lote.exe DllHost.exe PID 844 wrote to memory of 2024 844 lote.exe DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1508 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1508 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1508 WinMail.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1880 cmd.exe -
Processes:
uncategorized_3.1.0.8.vir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy uncategorized_3.1.0.8.vir.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" uncategorized_3.1.0.8.vir.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
uncategorized_3.1.0.8.vir.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 900 uncategorized_3.1.0.8.vir.exe Token: SeSecurityPrivilege 900 uncategorized_3.1.0.8.vir.exe Token: SeSecurityPrivilege 900 uncategorized_3.1.0.8.vir.exe Token: SeManageVolumePrivilege 1508 WinMail.exe -
Loads dropped DLL 2 IoCs
Processes:
uncategorized_3.1.0.8.vir.exepid process 900 uncategorized_3.1.0.8.vir.exe 900 uncategorized_3.1.0.8.vir.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\0AC852D3-00000001.eml:OECustomProperty WinMail.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uncategorized_3.1.0.8.vir.exedescription pid process target process PID 900 set thread context of 1880 900 uncategorized_3.1.0.8.vir.exe cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
lote.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\Currentversion\Run lote.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{E0B4F63B-F313-009F-D49F-05A38B833D61} = "C:\\Users\\Admin\\AppData\\Roaming\\Safa\\lote.exe" lote.exe -
Executes dropped EXE 1 IoCs
Processes:
lote.exepid process 844 lote.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
lote.exepid process 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe 844 lote.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\uncategorized_3.1.0.8.vir.exe"C:\Users\Admin\AppData\Local\Temp\uncategorized_3.1.0.8.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Safa\lote.exe"C:\Users\Admin\AppData\Roaming\Safa\lote.exe"3⤵
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp29c10d8f.bat"3⤵
- Deletes itself
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- NTFS ADS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp29c10d8f.bat
-
C:\Users\Admin\AppData\Roaming\Safa\lote.exe
-
C:\Users\Admin\AppData\Roaming\Safa\lote.exe
-
C:\Users\Admin\AppData\Roaming\Xekeec\kiaq.hen
-
\Users\Admin\AppData\Roaming\Safa\lote.exe
-
\Users\Admin\AppData\Roaming\Safa\lote.exe
-
memory/844-2-0x0000000000000000-mapping.dmp
-
memory/1508-5-0x0000000003920000-0x0000000003A20000-memory.dmpFilesize
1024KB
-
memory/1508-7-0x0000000003920000-0x0000000003B20000-memory.dmpFilesize
2.0MB
-
memory/1508-9-0x0000000003920000-0x0000000003A20000-memory.dmpFilesize
1024KB
-
memory/1508-10-0x0000000003920000-0x0000000003B20000-memory.dmpFilesize
2.0MB
-
memory/1508-11-0x0000000003A20000-0x0000000003B20000-memory.dmpFilesize
1024KB
-
memory/1508-15-0x0000000002650000-0x0000000002652000-memory.dmpFilesize
8KB
-
memory/1508-16-0x0000000002670000-0x0000000002672000-memory.dmpFilesize
8KB
-
memory/1508-17-0x0000000002660000-0x0000000002662000-memory.dmpFilesize
8KB
-
memory/1508-18-0x0000000003F50000-0x0000000003F52000-memory.dmpFilesize
8KB
-
memory/1508-19-0x0000000003D80000-0x0000000003D82000-memory.dmpFilesize
8KB
-
memory/1508-20-0x0000000003BC0000-0x0000000003BC2000-memory.dmpFilesize
8KB
-
memory/1508-21-0x0000000003D80000-0x0000000003D82000-memory.dmpFilesize
8KB
-
memory/1508-22-0x0000000003D30000-0x0000000003D32000-memory.dmpFilesize
8KB
-
memory/1508-23-0x0000000002650000-0x0000000002652000-memory.dmpFilesize
8KB
-
memory/1508-24-0x0000000003D60000-0x0000000003D62000-memory.dmpFilesize
8KB
-
memory/1508-25-0x0000000003E10000-0x0000000003E12000-memory.dmpFilesize
8KB
-
memory/1508-26-0x0000000003FC0000-0x0000000003FC2000-memory.dmpFilesize
8KB
-
memory/1508-27-0x0000000003E20000-0x0000000003E22000-memory.dmpFilesize
8KB
-
memory/1508-28-0x0000000003D70000-0x0000000003D72000-memory.dmpFilesize
8KB
-
memory/1508-29-0x0000000003D30000-0x0000000003D32000-memory.dmpFilesize
8KB
-
memory/1508-30-0x0000000003F60000-0x0000000003F62000-memory.dmpFilesize
8KB
-
memory/1508-31-0x0000000003FA0000-0x0000000003FA2000-memory.dmpFilesize
8KB
-
memory/1508-32-0x00000000042E0000-0x00000000042E2000-memory.dmpFilesize
8KB
-
memory/1508-33-0x0000000004760000-0x0000000004762000-memory.dmpFilesize
8KB
-
memory/1508-34-0x00000000042F0000-0x00000000042F2000-memory.dmpFilesize
8KB
-
memory/1508-35-0x00000000046D0000-0x00000000046D2000-memory.dmpFilesize
8KB
-
memory/1508-36-0x0000000004300000-0x0000000004302000-memory.dmpFilesize
8KB
-
memory/1508-37-0x00000000046C0000-0x00000000046C2000-memory.dmpFilesize
8KB
-
memory/1508-38-0x0000000004320000-0x0000000004322000-memory.dmpFilesize
8KB
-
memory/1508-39-0x00000000045D0000-0x00000000045D2000-memory.dmpFilesize
8KB
-
memory/1508-40-0x00000000045C0000-0x00000000045C2000-memory.dmpFilesize
8KB
-
memory/1508-41-0x00000000045B0000-0x00000000045B2000-memory.dmpFilesize
8KB
-
memory/1508-42-0x00000000045A0000-0x00000000045A2000-memory.dmpFilesize
8KB
-
memory/1508-43-0x0000000004340000-0x0000000004342000-memory.dmpFilesize
8KB
-
memory/1508-44-0x0000000003D00000-0x0000000003D02000-memory.dmpFilesize
8KB
-
memory/1508-45-0x0000000003D20000-0x0000000003D22000-memory.dmpFilesize
8KB
-
memory/1508-46-0x00000000045F0000-0x00000000045F2000-memory.dmpFilesize
8KB
-
memory/1508-47-0x0000000004610000-0x0000000004612000-memory.dmpFilesize
8KB
-
memory/1508-48-0x0000000004CF0000-0x0000000004CF2000-memory.dmpFilesize
8KB
-
memory/1508-49-0x0000000004D00000-0x0000000004D02000-memory.dmpFilesize
8KB
-
memory/1508-50-0x0000000004D10000-0x0000000004D12000-memory.dmpFilesize
8KB
-
memory/1508-51-0x0000000004D20000-0x0000000004D22000-memory.dmpFilesize
8KB
-
memory/1508-52-0x0000000003920000-0x0000000003A20000-memory.dmpFilesize
1024KB
-
memory/1508-54-0x00000000023D0000-0x00000000023E0000-memory.dmpFilesize
64KB
-
memory/1508-60-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/1880-66-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1880-68-0x000000000005A4E7-mapping.dmp