Analysis
- max time kernel
150s - max time network
128s - platform
windows10_x64 - resource
win10v200722 - submitted
31/07/2020, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
7ec7ad0d3f7b79d6d49eeb67fcb26b59.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 7ec7ad0d3f7b79d6d49eeb67fcb26b59.exe
- Size 444KB
- Sample200731-7j61mbjrbx
- SHA256 06cedd3e446db41cd53877ce7b7c24c31bc034260d7de377c01bb06e1ea9add0
- MD5 7ec7ad0d3f7b79d6d49eeb67fcb26b59
- SHA1 8fa87f354fa83228399a5a74340abe5a3a363e0c
- SHA512 1803f65ed460d873ad172814f6210f64f9caba099a86881a259d6d455b78dbb92810f6e5cfa062151ff1131c3c55671160150d7e242cde493e3eaa978a4a2006
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 808 set thread context of 2112 808 cmd.exe 56 PID 3992 set thread context of 2112 3992 systray.exe 56 - Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/808-4-0x0000000000000000-mapping.dmp formbook behavioral2/memory/3992-5-0x0000000000000000-mapping.dmp formbook - Suspicious use of WriteProcessMemory 88 IoCs
description pid Process procid_target PID 3876 wrote to memory of 636 3876 7ec7ad0d3f7b79d6d49eeb67fcb26b59.exe 66 PID 3876 wrote to memory of 636 3876 7ec7ad0d3f7b79d6d49eeb67fcb26b59.exe 66 PID 3876 wrote to memory of 636 3876 7ec7ad0d3f7b79d6d49eeb67fcb26b59.exe 66 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 636 wrote to memory of 808 636 rundll32.exe 67 PID 2112 wrote to memory of 3992 2112 Explorer.EXE 73 PID 2112 wrote to memory of 3992 2112 Explorer.EXE 73 PID 2112 wrote to memory of 3992 2112 Explorer.EXE 73 PID 3992 wrote to memory of 2724 3992 systray.exe 74 PID 3992 wrote to memory of 2724 3992 systray.exe 74 PID 3992 wrote to memory of 2724 3992 systray.exe 74 - Loads dropped DLL 1 IoCs
pid Process 636 rundll32.exe - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 636 rundll32.exe 808 cmd.exe 808 cmd.exe 808 cmd.exe 808 cmd.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe 3992 systray.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 636 rundll32.exe 808 cmd.exe 808 cmd.exe 808 cmd.exe 3992 systray.exe 3992 systray.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 808 cmd.exe Token: SeDebugPrivilege 3992 systray.exe Token: SeShutdownPrivilege 2112 Explorer.EXE Token: SeCreatePagefilePrivilege 2112 Explorer.EXE Token: SeShutdownPrivilege 2112 Explorer.EXE Token: SeCreatePagefilePrivilege 2112 Explorer.EXE Token: SeShutdownPrivilege 2112 Explorer.EXE Token: SeCreatePagefilePrivilege 2112 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\7ec7ad0d3f7b79d6d49eeb67fcb26b59.exe"C:\Users\Admin\AppData\Local\Temp\7ec7ad0d3f7b79d6d49eeb67fcb26b59.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe BicornGasohol,Sunhats3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:636 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3992 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:2724
-
-