Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10 - submitted
20/09/2020, 04:00
Static task
static1
Behavioral task
behavioral1
Sample
97fdb440587ae6f237203b2e0338a550.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
97fdb440587ae6f237203b2e0338a550.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 97fdb440587ae6f237203b2e0338a550.exe
- Size 77KB
- Sample200920-mbht23cwf2
- SHA256 7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858
- MD5 97fdb440587ae6f237203b2e0338a550
- SHA1 a8613ac0c99ea6d5073d7474b278794b50f30b24
- SHA512 e9e339b95128af836f286fbce08f92ee20f492f4d669c1194c8eecaf86b62a9740301714a20c05a70c0b1d8b31119bff120e2146b19906183706783bee0633aa
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
pid Process 908 svchost.exe 1268 3870938709.exe 1440 1153524310.exe 1600 svchost.exe 2548 14248.exe 2824 3024825527.exe 2928 1534532421.exe -
resource yara_rule behavioral2/memory/3256-22-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3256-22-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3256-23-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3256-23-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3256-24-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3256-24-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3256-26-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3256-26-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3256-31-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/3256-31-0x0000000000400000-0x0000000000A16000-memory.dmp upx - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ulZYCdTsml.url wscript.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\26363444222628\\svchost.exe" 97fdb440587ae6f237203b2e0338a550.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\26363444222628\\svchost.exe" 97fdb440587ae6f237203b2e0338a550.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\56851672719905\\svchost.exe" 3870938709.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\56851672719905\\svchost.exe" 3870938709.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2548 set thread context of 3256 2548 14248.exe 82 - Suspicious behavior: EnumeratesProcesses 72 IoCs
pid Process 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe 2548 14248.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2548 14248.exe Token: SeLockMemoryPrivilege 3256 notepad.exe Token: SeLockMemoryPrivilege 3256 notepad.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 3828 wrote to memory of 908 3828 97fdb440587ae6f237203b2e0338a550.exe 76 PID 3828 wrote to memory of 908 3828 97fdb440587ae6f237203b2e0338a550.exe 76 PID 3828 wrote to memory of 908 3828 97fdb440587ae6f237203b2e0338a550.exe 76 PID 908 wrote to memory of 1268 908 svchost.exe 77 PID 908 wrote to memory of 1268 908 svchost.exe 77 PID 908 wrote to memory of 1268 908 svchost.exe 77 PID 908 wrote to memory of 1440 908 svchost.exe 78 PID 908 wrote to memory of 1440 908 svchost.exe 78 PID 908 wrote to memory of 1440 908 svchost.exe 78 PID 1268 wrote to memory of 1600 1268 3870938709.exe 79 PID 1268 wrote to memory of 1600 1268 3870938709.exe 79 PID 1268 wrote to memory of 1600 1268 3870938709.exe 79 PID 1440 wrote to memory of 2548 1440 1153524310.exe 80 PID 1440 wrote to memory of 2548 1440 1153524310.exe 80 PID 1440 wrote to memory of 2548 1440 1153524310.exe 80 PID 1600 wrote to memory of 2824 1600 svchost.exe 81 PID 1600 wrote to memory of 2824 1600 svchost.exe 81 PID 1600 wrote to memory of 2824 1600 svchost.exe 81 PID 2548 wrote to memory of 3256 2548 14248.exe 82 PID 2548 wrote to memory of 3256 2548 14248.exe 82 PID 2548 wrote to memory of 3256 2548 14248.exe 82 PID 2548 wrote to memory of 3256 2548 14248.exe 82 PID 2548 wrote to memory of 3256 2548 14248.exe 82 PID 2548 wrote to memory of 3256 2548 14248.exe 82 PID 2548 wrote to memory of 3256 2548 14248.exe 82 PID 1600 wrote to memory of 2928 1600 svchost.exe 83 PID 1600 wrote to memory of 2928 1600 svchost.exe 83 PID 1600 wrote to memory of 2928 1600 svchost.exe 83 PID 2548 wrote to memory of 3256 2548 14248.exe 82 PID 2548 wrote to memory of 380 2548 14248.exe 84 PID 2548 wrote to memory of 380 2548 14248.exe 84 PID 2548 wrote to memory of 380 2548 14248.exe 84 PID 380 wrote to memory of 2412 380 cmd.exe 86 PID 380 wrote to memory of 2412 380 cmd.exe 86 PID 380 wrote to memory of 2412 380 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\97fdb440587ae6f237203b2e0338a550.exe"C:\Users\Admin\AppData\Local\Temp\97fdb440587ae6f237203b2e0338a550.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\26363444222628\svchost.exeC:\26363444222628\svchost.exe2⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\3870938709.exeC:\Users\Admin\AppData\Local\Temp\3870938709.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\56851672719905\svchost.exeC:\56851672719905\svchost.exe4⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3024825527.exeC:\Users\Admin\AppData\Local\Temp\3024825527.exe5⤵
- Executes dropped EXE
PID:2824
-
-
C:\Users\Admin\AppData\Local\Temp\1534532421.exeC:\Users\Admin\AppData\Local\Temp\1534532421.exe5⤵
- Executes dropped EXE
PID:2928
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1153524310.exeC:\Users\Admin\AppData\Local\Temp\1153524310.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\14248.exeC:\Users\Admin\AppData\Local\Temp\14248.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\PnQssBdbSh\cfgi"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C WScript "C:\ProgramData\PnQssBdbSh\r.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\wscript.exeWScript "C:\ProgramData\PnQssBdbSh\r.vbs"6⤵
- Drops startup file
PID:2412
-
-
-
-
-