Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
29-07-2020 11:26
Static task
static1
Behavioral task
behavioral1
Sample
SKM_454e20070310530.SCR
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SKM_454e20070310530.SCR
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
SKM_454e20070310530.SCR
-
Size
808KB
-
MD5
fd239f6ff382ff48c0b544c650f7e04b
-
SHA1
f07e1454a8b708c150490fc454623519dfd6cef3
-
SHA256
b68844095af181c139ed272cb04e830f803770518ad9dd78cb789e8f4571b4c3
-
SHA512
122000268724443c5bcfb5a071310e31f838ccee106e868bcdf0ee8d045617e3b65ac52495c6e7cda54b0aec530aa130473b07c5b7114e44a48b64989213b86f
Score
8/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
SKM_454e20070310530.SCRequvnynyhei.exedescription pid process target process PID 852 set thread context of 1604 852 SKM_454e20070310530.SCR SKM_454e20070310530.SCR PID 1164 set thread context of 1040 1164 equvnynyhei.exe equvnynyhei.exe -
Loads dropped DLL 6 IoCs
Processes:
SKM_454e20070310530.SCRequvnynyhei.exepid process 1604 SKM_454e20070310530.SCR 1604 SKM_454e20070310530.SCR 1604 SKM_454e20070310530.SCR 1604 SKM_454e20070310530.SCR 1040 equvnynyhei.exe 1040 equvnynyhei.exe -
Suspicious use of AdjustPrivilegeToken 1402 IoCs
Processes:
SKM_454e20070310530.SCRequvnynyhei.exedescription pid process Token: SeSecurityPrivilege 1604 SKM_454e20070310530.SCR Token: SeSecurityPrivilege 1604 SKM_454e20070310530.SCR Token: SeSecurityPrivilege 1604 SKM_454e20070310530.SCR Token: SeSecurityPrivilege 1604 SKM_454e20070310530.SCR Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe Token: SeSecurityPrivilege 1040 equvnynyhei.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
equvnynyhei.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\SOFTWARE\Microsoft\Windows\Currentversion\Run equvnynyhei.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Currentversion\Run equvnynyhei.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\Beygaqyp = "C:\\Users\\Admin\\AppData\\Roaming\\Epmiocte\\equvnynyhei.exe" equvnynyhei.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
SKM_454e20070310530.SCRSKM_454e20070310530.SCRequvnynyhei.exeequvnynyhei.exepid process 852 SKM_454e20070310530.SCR 1604 SKM_454e20070310530.SCR 1164 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe 1040 equvnynyhei.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
SKM_454e20070310530.SCRSKM_454e20070310530.SCRequvnynyhei.exeequvnynyhei.exedescription pid process target process PID 852 wrote to memory of 1604 852 SKM_454e20070310530.SCR SKM_454e20070310530.SCR PID 852 wrote to memory of 1604 852 SKM_454e20070310530.SCR SKM_454e20070310530.SCR PID 852 wrote to memory of 1604 852 SKM_454e20070310530.SCR SKM_454e20070310530.SCR PID 852 wrote to memory of 1604 852 SKM_454e20070310530.SCR SKM_454e20070310530.SCR PID 1604 wrote to memory of 1164 1604 SKM_454e20070310530.SCR equvnynyhei.exe PID 1604 wrote to memory of 1164 1604 SKM_454e20070310530.SCR equvnynyhei.exe PID 1604 wrote to memory of 1164 1604 SKM_454e20070310530.SCR equvnynyhei.exe PID 1604 wrote to memory of 1164 1604 SKM_454e20070310530.SCR equvnynyhei.exe PID 1164 wrote to memory of 1040 1164 equvnynyhei.exe equvnynyhei.exe PID 1164 wrote to memory of 1040 1164 equvnynyhei.exe equvnynyhei.exe PID 1164 wrote to memory of 1040 1164 equvnynyhei.exe equvnynyhei.exe PID 1164 wrote to memory of 1040 1164 equvnynyhei.exe equvnynyhei.exe PID 1604 wrote to memory of 1536 1604 SKM_454e20070310530.SCR cmd.exe PID 1604 wrote to memory of 1536 1604 SKM_454e20070310530.SCR cmd.exe PID 1604 wrote to memory of 1536 1604 SKM_454e20070310530.SCR cmd.exe PID 1604 wrote to memory of 1536 1604 SKM_454e20070310530.SCR cmd.exe PID 1040 wrote to memory of 1084 1040 equvnynyhei.exe taskhost.exe PID 1040 wrote to memory of 1084 1040 equvnynyhei.exe taskhost.exe PID 1040 wrote to memory of 1084 1040 equvnynyhei.exe taskhost.exe PID 1040 wrote to memory of 1084 1040 equvnynyhei.exe taskhost.exe PID 1040 wrote to memory of 1084 1040 equvnynyhei.exe taskhost.exe PID 1040 wrote to memory of 1140 1040 equvnynyhei.exe Dwm.exe PID 1040 wrote to memory of 1140 1040 equvnynyhei.exe Dwm.exe PID 1040 wrote to memory of 1140 1040 equvnynyhei.exe Dwm.exe PID 1040 wrote to memory of 1140 1040 equvnynyhei.exe Dwm.exe PID 1040 wrote to memory of 1140 1040 equvnynyhei.exe Dwm.exe PID 1040 wrote to memory of 1204 1040 equvnynyhei.exe Explorer.EXE PID 1040 wrote to memory of 1204 1040 equvnynyhei.exe Explorer.EXE PID 1040 wrote to memory of 1204 1040 equvnynyhei.exe Explorer.EXE PID 1040 wrote to memory of 1204 1040 equvnynyhei.exe Explorer.EXE PID 1040 wrote to memory of 1204 1040 equvnynyhei.exe Explorer.EXE PID 1040 wrote to memory of 1936 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1936 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1936 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1936 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1936 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1732 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1732 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1732 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1732 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1732 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1360 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1360 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1360 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1360 1040 equvnynyhei.exe DllHost.exe PID 1040 wrote to memory of 1360 1040 equvnynyhei.exe DllHost.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1536 cmd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
SKM_454e20070310530.SCRequvnynyhei.exepid process 852 SKM_454e20070310530.SCR 1164 equvnynyhei.exe -
Executes dropped EXE 2 IoCs
Processes:
equvnynyhei.exeequvnynyhei.exepid process 1164 equvnynyhei.exe 1040 equvnynyhei.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.SCR"C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.SCR" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.SCR"C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.SCR" /S3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Epmiocte\equvnynyhei.exe"C:\Users\Admin\AppData\Roaming\Epmiocte\equvnynyhei.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Epmiocte\equvnynyhei.exe"C:\Users\Admin\AppData\Roaming\Epmiocte\equvnynyhei.exe"5⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp9548fc54.bat"4⤵
- Deletes itself
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9548fc54.bat
-
C:\Users\Admin\AppData\Roaming\Epmiocte\equvnynyhei.exe
-
C:\Users\Admin\AppData\Roaming\Epmiocte\equvnynyhei.exe
-
C:\Users\Admin\AppData\Roaming\Epmiocte\equvnynyhei.exe
-
\Users\Admin\AppData\Local\Temp\tmp3FAE.tmp
-
\Users\Admin\AppData\Local\Temp\tmp3FED.tmp
-
\Users\Admin\AppData\Local\Temp\tmp4FB4.tmp
-
\Users\Admin\AppData\Local\Temp\tmp4FD5.tmp
-
\Users\Admin\AppData\Roaming\Epmiocte\equvnynyhei.exe
-
\Users\Admin\AppData\Roaming\Epmiocte\equvnynyhei.exe
-
memory/1040-11-0x000000000043F4D4-mapping.dmp
-
memory/1164-7-0x0000000000000000-mapping.dmp
-
memory/1536-14-0x0000000000000000-mapping.dmp
-
memory/1604-0-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1604-2-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1604-1-0x000000000043F4D4-mapping.dmp