Malware Analysis Report

2024-11-13 16:48

Sample ID 200911-daccwmhwzn
Target b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76
SHA256 b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76
Tags
buer loader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76

Threat Level: Known bad

The file b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76 was found to be: Known bad.

Malicious Activity Summary

buer loader

Buer

Buer Loader

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2020-09-11 09:34

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2020-09-11 09:34

Reported

2020-09-11 09:36

Platform

win7v200722

Max time kernel

5s

Max time network

10s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe"

Signatures

Buer

loader buer

Buer Loader

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe

"C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe"

Network

N/A

Files

memory/368-0-0x0000000000000000-mapping.dmp

memory/368-1-0x0000000040000000-0x000000004000C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2020-09-11 09:34

Reported

2020-09-11 09:36

Platform

win10

Max time kernel

9s

Max time network

111s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe

"C:\Users\Admin\AppData\Local\Temp\b8ca4a1bbc740c39d4b27a3992d7b5554c99af3c6e16f7a91e1a2c9fde6b3b76.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 368

Network

Country Destination Domain Proto
N/A 13.107.4.52:80 www.msftconnecttest.com tcp

Files

memory/3608-0-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

memory/3608-1-0x00000000050D0000-0x00000000050D1000-memory.dmp