84742df4cd63ab373d601a9f4900b1b55f41ea5f48d93eaebb68b9fd4bf8235a

Analysis

max time kernel
116s
max time network
116s
platform
windows10_x64
resource
win10
submitted
17/08/2020, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEFTSBIN220227540696.exe
Size 1.2MB
Sample200817-rn175thmp6
SHA256 84742df4cd63ab373d601a9f4900b1b55f41ea5f48d93eaebb68b9fd4bf8235a
MD5 d0b1268b6d2c57344550cb717497256d
SHA1 62744c5f68de9e34e2a46eb82fa44ca61b3edb04
SHA512 6a4bf0e97c9740ca1482a944b2104461feadbd246b4ed7cf6e4047b6687c18511dcbae070c29fe933338c4795eec38d61be51497feab3549363d0ff40ddf9b0d
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3196-0-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3196-0-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3196-2-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3196-2-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3196-3-0x0000000000400000-0x0000000000582000-memory.dmp	upx
behavioral2/memory/3196-3-0x0000000000400000-0x0000000000582000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
3988	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3908 set thread context of 3196	3908	NEFTSBIN220227540696.exe	67

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3908	NEFTSBIN220227540696.exe
3908	NEFTSBIN220227540696.exe
3196	NEFTSBIN220227540696.exe
3196	NEFTSBIN220227540696.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3908	NEFTSBIN220227540696.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	NEFTSBIN220227540696.exe
Token: SeDebugPrivilege	3988	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3196	3908	NEFTSBIN220227540696.exe	67
PID 3908 wrote to memory of 3196	3908	NEFTSBIN220227540696.exe	67
PID 3908 wrote to memory of 3196	3908	NEFTSBIN220227540696.exe	67
PID 3196 wrote to memory of 2652	3196	NEFTSBIN220227540696.exe	69
PID 3196 wrote to memory of 2652	3196	NEFTSBIN220227540696.exe	69
PID 3196 wrote to memory of 2652	3196	NEFTSBIN220227540696.exe	69
PID 2652 wrote to memory of 3988	2652	cmd.exe	71
PID 2652 wrote to memory of 3988	2652	cmd.exe	71
PID 2652 wrote to memory of 3988	2652	cmd.exe	71

C:\Users\Admin\AppData\Local\Temp\NEFTSBIN220227540696.exe
"C:\Users\Admin\AppData\Local\Temp\NEFTSBIN220227540696.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Users\Admin\AppData\Local\Temp\NEFTSBIN220227540696.exe
  "C:\Users\Admin\AppData\Local\Temp\NEFTSBIN220227540696.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\NEFTSBIN220227540696.exe' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\NEFTSBIN220227540696.exe'
      4⤵
      Deletes itself
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3196-6-0x0000000073A90000-0x000000007417E000-memory.dmp

Download

memory/3196-2-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3196-3-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3196-4-0x0000000002400000-0x00000000024B8000-memory.dmp

Download

memory/3196-5-0x0000000000B52000-0x0000000000B53000-memory.dmp

Download

memory/3196-0-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3196-9-0x0000000004C70000-0x0000000004C71000-memory.dmp

Download

memory/3196-10-0x00000000029B0000-0x00000000029B1000-memory.dmp

Download

memory/3196-11-0x0000000004A90000-0x0000000004B01000-memory.dmp

Download

memory/3196-12-0x0000000004B10000-0x0000000004B11000-memory.dmp

Download

memory/3196-13-0x0000000004B80000-0x0000000004B81000-memory.dmp

Download

memory/3988-23-0x00000000085A0000-0x00000000085A1000-memory.dmp

Download

memory/3988-17-0x0000000074000000-0x00000000746EE000-memory.dmp

Download

memory/3988-18-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/3988-19-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

Download

memory/3988-20-0x0000000007B30000-0x0000000007B31000-memory.dmp

Download

memory/3988-21-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

Download

memory/3988-24-0x0000000008400000-0x0000000008401000-memory.dmp

Download

memory/3988-25-0x0000000008B20000-0x0000000008B21000-memory.dmp

Download

memory/3988-26-0x0000000008C80000-0x0000000008C81000-memory.dmp

Download

memory/3988-27-0x000000000A340000-0x000000000A341000-memory.dmp

Download

memory/3988-28-0x0000000009AF0000-0x0000000009AF1000-memory.dmp

Download

memory/3988-29-0x0000000009CC0000-0x0000000009CC1000-memory.dmp

Download

memory/3988-30-0x00000000077C0000-0x00000000077C1000-memory.dmp

Download