4b8a4abd0ae086c71b87e2ed0983f96eb9bf010f5ca10c0f37bbafbc1ebe2a1d

Analysis

max time kernel
150s
max time network
150s
platform
windows10_x64
resource
win10
submitted
19/07/2020, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
grabbot_0.1.5.7.vir.exe
Size 295KB
Sample200719-sacd87lbhj
SHA256 4b8a4abd0ae086c71b87e2ed0983f96eb9bf010f5ca10c0f37bbafbc1ebe2a1d
MD5 dd2b1a1fc046abf55727f77ec9464f63
SHA1 1d9106e9460ea756b84bc4cc8b730a69b0b19836
SHA512 f7c9c0703e68109ad6439e204c6c053661e5e902d8aee60ad29d8106b0c0a70b9516e52b4ce4367c556dc2482979f232b56fc31dd9e450d81c1344f8648e0bbb
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 28 IoCs

pid	Process
3688	JcAk3KCs.exe
3880	CW3YdAxF.exe
4032	B66p2NWT.exe
3852	Fe9HNwXp.exe
4056	NYLGVGoJ.exe
3896	3MnNSsuI.exe
3812	5pJbo4mR.exe
3992	qG7AExuQ.exe
3984	iy1Uo7fb.exe
1836	OEh0FMuj.exe
1852	KbhjK2dJ.exe
900	iqObEPRc.exe
1644	0Qat1ZE5.exe
1804	LZs4uFCh.exe
2036	QyAFlYI5.exe
2172	Js5MWdCK.exe
2224	oKpbyJSH.exe
2692	HcrNutVb.exe
2756	PYLjX1Vg.exe
3388	XTJlVvQV.exe
588	RfeYIC8n.exe
3792	Hx92jk4r.exe
3004	XrQbAfq7.exe
3728	M7CFSB3p.exe
3832	49K6aSY0.exe
3852	2lTWUdSv.exe
392	Sf7N6tFe.exe
3944	WCNZJ9DJ.exe

Suspicious behavior: EnumeratesProcesses 84 IoCs

pid	Process
792	grabbot_0.1.5.7.vir.exe
792	grabbot_0.1.5.7.vir.exe
792	grabbot_0.1.5.7.vir.exe
3688	JcAk3KCs.exe
3688	JcAk3KCs.exe
3688	JcAk3KCs.exe
3880	CW3YdAxF.exe
3880	CW3YdAxF.exe
3880	CW3YdAxF.exe
4032	B66p2NWT.exe
4032	B66p2NWT.exe
4032	B66p2NWT.exe
3852	Fe9HNwXp.exe
3852	Fe9HNwXp.exe
3852	Fe9HNwXp.exe
4056	NYLGVGoJ.exe
4056	NYLGVGoJ.exe
4056	NYLGVGoJ.exe
3896	3MnNSsuI.exe
3896	3MnNSsuI.exe
3896	3MnNSsuI.exe
3812	5pJbo4mR.exe
3812	5pJbo4mR.exe
3812	5pJbo4mR.exe
3992	qG7AExuQ.exe
3992	qG7AExuQ.exe
3992	qG7AExuQ.exe
3984	iy1Uo7fb.exe
3984	iy1Uo7fb.exe
3984	iy1Uo7fb.exe
1836	OEh0FMuj.exe
1836	OEh0FMuj.exe
1836	OEh0FMuj.exe
1852	KbhjK2dJ.exe
1852	KbhjK2dJ.exe
1852	KbhjK2dJ.exe
900	iqObEPRc.exe
900	iqObEPRc.exe
900	iqObEPRc.exe
1644	0Qat1ZE5.exe
1644	0Qat1ZE5.exe
1644	0Qat1ZE5.exe
1804	LZs4uFCh.exe
1804	LZs4uFCh.exe
1804	LZs4uFCh.exe
2036	QyAFlYI5.exe
2036	QyAFlYI5.exe
2036	QyAFlYI5.exe
2172	Js5MWdCK.exe
2172	Js5MWdCK.exe
2172	Js5MWdCK.exe
2224	oKpbyJSH.exe
2224	oKpbyJSH.exe
2224	oKpbyJSH.exe
2692	HcrNutVb.exe
2692	HcrNutVb.exe
2692	HcrNutVb.exe
2756	PYLjX1Vg.exe
2756	PYLjX1Vg.exe
2756	PYLjX1Vg.exe
3388	XTJlVvQV.exe
3388	XTJlVvQV.exe
3388	XTJlVvQV.exe
588	RfeYIC8n.exe
588	RfeYIC8n.exe
588	RfeYIC8n.exe
3792	Hx92jk4r.exe
3792	Hx92jk4r.exe
3792	Hx92jk4r.exe
3004	XrQbAfq7.exe
3004	XrQbAfq7.exe
3004	XrQbAfq7.exe
3728	M7CFSB3p.exe
3728	M7CFSB3p.exe
3728	M7CFSB3p.exe
3832	49K6aSY0.exe
3832	49K6aSY0.exe
3832	49K6aSY0.exe
3852	2lTWUdSv.exe
3852	2lTWUdSv.exe
3852	2lTWUdSv.exe
392	Sf7N6tFe.exe
392	Sf7N6tFe.exe
392	Sf7N6tFe.exe

Suspicious use of WriteProcessMemory 84 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 3688	792	grabbot_0.1.5.7.vir.exe	66
PID 792 wrote to memory of 3688	792	grabbot_0.1.5.7.vir.exe	66
PID 792 wrote to memory of 3688	792	grabbot_0.1.5.7.vir.exe	66
PID 3688 wrote to memory of 3880	3688	JcAk3KCs.exe	67
PID 3688 wrote to memory of 3880	3688	JcAk3KCs.exe	67
PID 3688 wrote to memory of 3880	3688	JcAk3KCs.exe	67
PID 3880 wrote to memory of 4032	3880	CW3YdAxF.exe	68
PID 3880 wrote to memory of 4032	3880	CW3YdAxF.exe	68
PID 3880 wrote to memory of 4032	3880	CW3YdAxF.exe	68
PID 4032 wrote to memory of 3852	4032	B66p2NWT.exe	69
PID 4032 wrote to memory of 3852	4032	B66p2NWT.exe	69
PID 4032 wrote to memory of 3852	4032	B66p2NWT.exe	69
PID 3852 wrote to memory of 4056	3852	Fe9HNwXp.exe	70
PID 3852 wrote to memory of 4056	3852	Fe9HNwXp.exe	70
PID 3852 wrote to memory of 4056	3852	Fe9HNwXp.exe	70
PID 4056 wrote to memory of 3896	4056	NYLGVGoJ.exe	71
PID 4056 wrote to memory of 3896	4056	NYLGVGoJ.exe	71
PID 4056 wrote to memory of 3896	4056	NYLGVGoJ.exe	71
PID 3896 wrote to memory of 3812	3896	3MnNSsuI.exe	72
PID 3896 wrote to memory of 3812	3896	3MnNSsuI.exe	72
PID 3896 wrote to memory of 3812	3896	3MnNSsuI.exe	72
PID 3812 wrote to memory of 3992	3812	5pJbo4mR.exe	73
PID 3812 wrote to memory of 3992	3812	5pJbo4mR.exe	73
PID 3812 wrote to memory of 3992	3812	5pJbo4mR.exe	73
PID 3992 wrote to memory of 3984	3992	qG7AExuQ.exe	74
PID 3992 wrote to memory of 3984	3992	qG7AExuQ.exe	74
PID 3992 wrote to memory of 3984	3992	qG7AExuQ.exe	74
PID 3984 wrote to memory of 1836	3984	iy1Uo7fb.exe	75
PID 3984 wrote to memory of 1836	3984	iy1Uo7fb.exe	75
PID 3984 wrote to memory of 1836	3984	iy1Uo7fb.exe	75
PID 1836 wrote to memory of 1852	1836	OEh0FMuj.exe	78
PID 1836 wrote to memory of 1852	1836	OEh0FMuj.exe	78
PID 1836 wrote to memory of 1852	1836	OEh0FMuj.exe	78
PID 1852 wrote to memory of 900	1852	KbhjK2dJ.exe	80
PID 1852 wrote to memory of 900	1852	KbhjK2dJ.exe	80
PID 1852 wrote to memory of 900	1852	KbhjK2dJ.exe	80
PID 900 wrote to memory of 1644	900	iqObEPRc.exe	84
PID 900 wrote to memory of 1644	900	iqObEPRc.exe	84
PID 900 wrote to memory of 1644	900	iqObEPRc.exe	84
PID 1644 wrote to memory of 1804	1644	0Qat1ZE5.exe	85
PID 1644 wrote to memory of 1804	1644	0Qat1ZE5.exe	85
PID 1644 wrote to memory of 1804	1644	0Qat1ZE5.exe	85
PID 1804 wrote to memory of 2036	1804	LZs4uFCh.exe	86
PID 1804 wrote to memory of 2036	1804	LZs4uFCh.exe	86
PID 1804 wrote to memory of 2036	1804	LZs4uFCh.exe	86
PID 2036 wrote to memory of 2172	2036	QyAFlYI5.exe	87
PID 2036 wrote to memory of 2172	2036	QyAFlYI5.exe	87
PID 2036 wrote to memory of 2172	2036	QyAFlYI5.exe	87
PID 2172 wrote to memory of 2224	2172	Js5MWdCK.exe	88
PID 2172 wrote to memory of 2224	2172	Js5MWdCK.exe	88
PID 2172 wrote to memory of 2224	2172	Js5MWdCK.exe	88
PID 2224 wrote to memory of 2692	2224	oKpbyJSH.exe	89
PID 2224 wrote to memory of 2692	2224	oKpbyJSH.exe	89
PID 2224 wrote to memory of 2692	2224	oKpbyJSH.exe	89
PID 2692 wrote to memory of 2756	2692	HcrNutVb.exe	90
PID 2692 wrote to memory of 2756	2692	HcrNutVb.exe	90
PID 2692 wrote to memory of 2756	2692	HcrNutVb.exe	90
PID 2756 wrote to memory of 3388	2756	PYLjX1Vg.exe	91
PID 2756 wrote to memory of 3388	2756	PYLjX1Vg.exe	91
PID 2756 wrote to memory of 3388	2756	PYLjX1Vg.exe	91
PID 3388 wrote to memory of 588	3388	XTJlVvQV.exe	92
PID 3388 wrote to memory of 588	3388	XTJlVvQV.exe	92
PID 3388 wrote to memory of 588	3388	XTJlVvQV.exe	92
PID 588 wrote to memory of 3792	588	RfeYIC8n.exe	93
PID 588 wrote to memory of 3792	588	RfeYIC8n.exe	93
PID 588 wrote to memory of 3792	588	RfeYIC8n.exe	93
PID 3792 wrote to memory of 3004	3792	Hx92jk4r.exe	94
PID 3792 wrote to memory of 3004	3792	Hx92jk4r.exe	94
PID 3792 wrote to memory of 3004	3792	Hx92jk4r.exe	94
PID 3004 wrote to memory of 3728	3004	XrQbAfq7.exe	95
PID 3004 wrote to memory of 3728	3004	XrQbAfq7.exe	95
PID 3004 wrote to memory of 3728	3004	XrQbAfq7.exe	95
PID 3728 wrote to memory of 3832	3728	M7CFSB3p.exe	96
PID 3728 wrote to memory of 3832	3728	M7CFSB3p.exe	96
PID 3728 wrote to memory of 3832	3728	M7CFSB3p.exe	96
PID 3832 wrote to memory of 3852	3832	49K6aSY0.exe	97
PID 3832 wrote to memory of 3852	3832	49K6aSY0.exe	97
PID 3832 wrote to memory of 3852	3832	49K6aSY0.exe	97
PID 3852 wrote to memory of 392	3852	2lTWUdSv.exe	98
PID 3852 wrote to memory of 392	3852	2lTWUdSv.exe	98
PID 3852 wrote to memory of 392	3852	2lTWUdSv.exe	98
PID 392 wrote to memory of 3944	392	Sf7N6tFe.exe	99
PID 392 wrote to memory of 3944	392	Sf7N6tFe.exe	99
PID 392 wrote to memory of 3944	392	Sf7N6tFe.exe	99

C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.5.7.vir.exe
"C:\Users\Admin\AppData\Local\Temp\grabbot_0.1.5.7.vir.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Roaming\JcAk3KCs.exe
  "C:\Users\Admin\AppData\Roaming\JcAk3KCs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Users\Admin\AppData\Roaming\CW3YdAxF.exe
    "C:\Users\Admin\AppData\Roaming\CW3YdAxF.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Users\Admin\AppData\Roaming\B66p2NWT.exe
      "C:\Users\Admin\AppData\Roaming\B66p2NWT.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\Users\Admin\AppData\Roaming\Fe9HNwXp.exe
        
        "C:\Users\Admin\AppData\Roaming\Fe9HNwXp.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3852
      - C:\Users\Admin\AppData\Roaming\NYLGVGoJ.exe
        
        "C:\Users\Admin\AppData\Roaming\NYLGVGoJ.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Users\Admin\AppData\Roaming\3MnNSsuI.exe
        
        "C:\Users\Admin\AppData\Roaming\3MnNSsuI.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Users\Admin\AppData\Roaming\5pJbo4mR.exe
        
        "C:\Users\Admin\AppData\Roaming\5pJbo4mR.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Users\Admin\AppData\Roaming\qG7AExuQ.exe
        
        "C:\Users\Admin\AppData\Roaming\qG7AExuQ.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Users\Admin\AppData\Roaming\iy1Uo7fb.exe
        
        "C:\Users\Admin\AppData\Roaming\iy1Uo7fb.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Users\Admin\AppData\Roaming\OEh0FMuj.exe
        
        "C:\Users\Admin\AppData\Roaming\OEh0FMuj.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Users\Admin\AppData\Roaming\KbhjK2dJ.exe
        
        "C:\Users\Admin\AppData\Roaming\KbhjK2dJ.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Users\Admin\AppData\Roaming\iqObEPRc.exe
        
        "C:\Users\Admin\AppData\Roaming\iqObEPRc.exe"
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Users\Admin\AppData\Roaming\0Qat1ZE5.exe
        
        "C:\Users\Admin\AppData\Roaming\0Qat1ZE5.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Users\Admin\AppData\Roaming\LZs4uFCh.exe
        
        "C:\Users\Admin\AppData\Roaming\LZs4uFCh.exe"
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Users\Admin\AppData\Roaming\QyAFlYI5.exe
        
        "C:\Users\Admin\AppData\Roaming\QyAFlYI5.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Users\Admin\AppData\Roaming\Js5MWdCK.exe
        
        "C:\Users\Admin\AppData\Roaming\Js5MWdCK.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Users\Admin\AppData\Roaming\oKpbyJSH.exe
        
        "C:\Users\Admin\AppData\Roaming\oKpbyJSH.exe"
        18⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Users\Admin\AppData\Roaming\HcrNutVb.exe
        
        "C:\Users\Admin\AppData\Roaming\HcrNutVb.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Users\Admin\AppData\Roaming\PYLjX1Vg.exe
        
        "C:\Users\Admin\AppData\Roaming\PYLjX1Vg.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Users\Admin\AppData\Roaming\XTJlVvQV.exe
        
        "C:\Users\Admin\AppData\Roaming\XTJlVvQV.exe"
        21⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Users\Admin\AppData\Roaming\RfeYIC8n.exe
        
        "C:\Users\Admin\AppData\Roaming\RfeYIC8n.exe"
        22⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:588
        
        C:\Users\Admin\AppData\Roaming\Hx92jk4r.exe
        
        "C:\Users\Admin\AppData\Roaming\Hx92jk4r.exe"
        23⤵
        Executes dropped EXE
        
        PID:3792
        
        C:\Users\Admin\AppData\Roaming\XrQbAfq7.exe
        
        "C:\Users\Admin\AppData\Roaming\XrQbAfq7.exe"
        24⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Users\Admin\AppData\Roaming\M7CFSB3p.exe
        
        "C:\Users\Admin\AppData\Roaming\M7CFSB3p.exe"
        25⤵
        Executes dropped EXE
        
        PID:3728
        
        C:\Users\Admin\AppData\Roaming\49K6aSY0.exe
        
        "C:\Users\Admin\AppData\Roaming\49K6aSY0.exe"
        26⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Users\Admin\AppData\Roaming\2lTWUdSv.exe
        
        "C:\Users\Admin\AppData\Roaming\2lTWUdSv.exe"
        27⤵
        Executes dropped EXE
        
        PID:3852
        
        C:\Users\Admin\AppData\Roaming\Sf7N6tFe.exe
        
        "C:\Users\Admin\AppData\Roaming\Sf7N6tFe.exe"
        28⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Users\Admin\AppData\Roaming\WCNZJ9DJ.exe
        
        "C:\Users\Admin\AppData\Roaming\WCNZJ9DJ.exe"
        29⤵
        Executes dropped EXE
        
        PID:3944

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads