318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd

Analysis

max time kernel
142s
max time network
152s
platform
windows10_x64
resource
win10v200722
submitted
25/09/2020, 09:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0dc61438b79668900bd081bac6109760.exe
Size 350KB
Sample200925-jnfqs54eej
SHA256 318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd
MD5 0dc61438b79668900bd081bac6109760
SHA1 2ee66fd972c2d28ad30775971ba95056951910f0
SHA512 467b352ce6188e6126050c229cd47b526e83ef3535449c3f02b70491e159523d7cc8ebb28caab4e8d98627a22a0af1faf13b134072309dfe56ad175d18177ca7
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3944	tpimqsw.exe
3312	tpimqsw.exe
492	tpimqsw.exe
3448	tpimqsw.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3740 set thread context of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3944 set thread context of 3312	3944	tpimqsw.exe	77
PID 492 set thread context of 3448	492	tpimqsw.exe	79

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\tpimqsw.job	0dc61438b79668900bd081bac6109760.exe
File opened for modification	C:\Windows\Tasks\tpimqsw.job	0dc61438b79668900bd081bac6109760.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3744	0dc61438b79668900bd081bac6109760.exe
3744	0dc61438b79668900bd081bac6109760.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3740 wrote to memory of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3740 wrote to memory of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3740 wrote to memory of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3740 wrote to memory of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3740 wrote to memory of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3740 wrote to memory of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3740 wrote to memory of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3740 wrote to memory of 3744	3740	0dc61438b79668900bd081bac6109760.exe	74
PID 3944 wrote to memory of 3312	3944	tpimqsw.exe	77
PID 3944 wrote to memory of 3312	3944	tpimqsw.exe	77
PID 3944 wrote to memory of 3312	3944	tpimqsw.exe	77
PID 3944 wrote to memory of 3312	3944	tpimqsw.exe	77
PID 3944 wrote to memory of 3312	3944	tpimqsw.exe	77
PID 3944 wrote to memory of 3312	3944	tpimqsw.exe	77
PID 3944 wrote to memory of 3312	3944	tpimqsw.exe	77
PID 3944 wrote to memory of 3312	3944	tpimqsw.exe	77
PID 3944 wrote to memory of 3312	3944	tpimqsw.exe	77
PID 492 wrote to memory of 3448	492	tpimqsw.exe	79
PID 492 wrote to memory of 3448	492	tpimqsw.exe	79
PID 492 wrote to memory of 3448	492	tpimqsw.exe	79
PID 492 wrote to memory of 3448	492	tpimqsw.exe	79
PID 492 wrote to memory of 3448	492	tpimqsw.exe	79
PID 492 wrote to memory of 3448	492	tpimqsw.exe	79
PID 492 wrote to memory of 3448	492	tpimqsw.exe	79
PID 492 wrote to memory of 3448	492	tpimqsw.exe	79
PID 492 wrote to memory of 3448	492	tpimqsw.exe	79

C:\Users\Admin\AppData\Local\Temp\0dc61438b79668900bd081bac6109760.exe
"C:\Users\Admin\AppData\Local\Temp\0dc61438b79668900bd081bac6109760.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\0dc61438b79668900bd081bac6109760.exe
  "C:\Users\Admin\AppData\Local\Temp\0dc61438b79668900bd081bac6109760.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3744

C:\ProgramData\kpbecfq\tpimqsw.exe
C:\ProgramData\kpbecfq\tpimqsw.exe start
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944
- C:\ProgramData\kpbecfq\tpimqsw.exe
  C:\ProgramData\kpbecfq\tpimqsw.exe start
  2⤵
  - Executes dropped EXE
  PID:3312

C:\ProgramData\kpbecfq\tpimqsw.exe
C:\ProgramData\kpbecfq\tpimqsw.exe start
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:492
- C:\ProgramData\kpbecfq\tpimqsw.exe
  C:\ProgramData\kpbecfq\tpimqsw.exe start
  2⤵
  - Executes dropped EXE
  PID:3448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-15-0x00000000012B0000-0x00000000012B1000-memory.dmp

Download

memory/492-14-0x0000000000F05000-0x0000000000F06000-memory.dmp

Download

memory/3740-1-0x0000000001330000-0x0000000001331000-memory.dmp

Download

memory/3740-0-0x0000000000EF3000-0x0000000000EF4000-memory.dmp

Download

memory/3744-4-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3744-2-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3944-8-0x0000000001270000-0x0000000001271000-memory.dmp

Download

memory/3944-7-0x0000000000F7C000-0x0000000000F7E000-memory.dmp

Download