ff0c4ed6bc9febde458e9115e3c558ae2740edf2252154fc1713c6621f0d7eae

Analysis

max time kernel
144s
max time network
151s
platform
windows10_x64
resource
win10
submitted
10/08/2020, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2020JULYSTATEMENTOFACCOUNT.exe
Size 1.4MB
Sample200810-gc6hsq22bx
SHA256 ff0c4ed6bc9febde458e9115e3c558ae2740edf2252154fc1713c6621f0d7eae
MD5 9868f8293536408a2a1e6c4978d0235a
SHA1 9087203883648ecd8b6f6cf9c7533e4102612913
SHA512 c3e0595595b4c8fd05c88ade2c3dea6c51c66c9bba0db5484f27c4793ff47b9b4bdd55f1a57fa5aaa5a5d5051f2ebdfd15365cc3388e5790800d507f06e1d319
MD5 SHA1 SHA512

Score

9^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\$$Images = "C:\\ProgramData\\images.exe"	2020JULYSTATEMENTOFACCOUNT.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 3904	976	2020JULYSTATEMENTOFACCOUNT.exe	68
PID 976 wrote to memory of 3904	976	2020JULYSTATEMENTOFACCOUNT.exe	68
PID 976 wrote to memory of 3904	976	2020JULYSTATEMENTOFACCOUNT.exe	68
PID 976 wrote to memory of 3620	976	2020JULYSTATEMENTOFACCOUNT.exe	70
PID 976 wrote to memory of 3620	976	2020JULYSTATEMENTOFACCOUNT.exe	70
PID 976 wrote to memory of 3620	976	2020JULYSTATEMENTOFACCOUNT.exe	70
PID 3620 wrote to memory of 2300	3620	images.exe	72
PID 3620 wrote to memory of 2300	3620	images.exe	72
PID 3620 wrote to memory of 2300	3620	images.exe	72
PID 3620 wrote to memory of 4056	3620	images.exe	73
PID 3620 wrote to memory of 4056	3620	images.exe	73
PID 3620 wrote to memory of 4056	3620	images.exe	73
PID 3620 wrote to memory of 4056	3620	images.exe	73
PID 3620 wrote to memory of 4056	3620	images.exe	73

Executes dropped EXE 1 IoCs

pid	Process
3620	images.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3904	powershell.exe
3904	powershell.exe
3904	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe

ServiceHost packer 1 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/4056-44-0x0000000000000000-mapping.dmp	servicehost

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	2020JULYSTATEMENTOFACCOUNT.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	2020JULYSTATEMENTOFACCOUNT.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	2020JULYSTATEMENTOFACCOUNT.exe

C:\Users\Admin\AppData\Local\Temp\2020JULYSTATEMENTOFACCOUNT.exe
"C:\Users\Admin\AppData\Local\Temp\2020JULYSTATEMENTOFACCOUNT.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Drops startup file
- NTFS ADS
PID:976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\ProgramData\images.exe
  "C:\ProgramData\images.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:3620
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-0-0x0000000000D10000-0x0000000000E64000-memory.dmp

Download

memory/2300-55-0x0000000008FD0000-0x0000000008FD1000-memory.dmp

Download

memory/2300-43-0x0000000007CF0000-0x0000000007CF1000-memory.dmp

Download

memory/2300-40-0x0000000007640000-0x0000000007641000-memory.dmp

Download

memory/2300-34-0x0000000073140000-0x000000007382E000-memory.dmp

Download

memory/3620-30-0x0000000003510000-0x0000000003664000-memory.dmp

Download

memory/3904-7-0x0000000006B60000-0x0000000006B61000-memory.dmp

Download

memory/3904-12-0x0000000007530000-0x0000000007531000-memory.dmp

Download

memory/3904-14-0x0000000007C80000-0x0000000007C81000-memory.dmp

Download

memory/3904-16-0x0000000008C00000-0x0000000008C33000-memory.dmp

Download

memory/3904-23-0x0000000008BE0000-0x0000000008BE1000-memory.dmp

Download

memory/3904-24-0x0000000008D40000-0x0000000008D41000-memory.dmp

Download

memory/3904-25-0x0000000008F00000-0x0000000008F01000-memory.dmp

Download

memory/3904-26-0x0000000008EB0000-0x0000000008EB1000-memory.dmp

Download

memory/3904-28-0x0000000008EA0000-0x0000000008EA1000-memory.dmp

Download

memory/3904-13-0x0000000007E60000-0x0000000007E61000-memory.dmp

Download

memory/3904-11-0x00000000075D0000-0x00000000075D1000-memory.dmp

Download

memory/3904-10-0x0000000007560000-0x0000000007561000-memory.dmp

Download

memory/3904-9-0x0000000007270000-0x0000000007271000-memory.dmp

Download

memory/3904-8-0x00000000071D0000-0x00000000071D1000-memory.dmp

Download

memory/3904-6-0x00000000064F0000-0x00000000064F1000-memory.dmp

Download

memory/3904-5-0x00000000736F0000-0x0000000073DDE000-memory.dmp

Download