e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e

Resubmissions

27/09/2020, 00:33

200927-n2q2v3n43s 6

10/09/2020, 08:49

200910-c8x1yrxskj 10

Analysis

max time kernel
130s
max time network
141s
platform
windows10_x64
resource
win10v200722
submitted
27/09/2020, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe
Size

379KB
MD5

9f00d78f2e8e4523773a264f85be1c02
SHA1

3c542144a7a03134060bd666206a106bcea95e5a
SHA256

e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e
SHA512

5760967703d0702d4c855b75c895a2432c809ca8f945f2a80914f21b3c8129c4bbf155bac4bb5fa6b03e868b3d33cfbe1b3321a7b438741cd62d1c3323d38928

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype Remote Control = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe"	e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3716	timeout.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 3012	788	e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe	76
PID 788 wrote to memory of 3012	788	e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe	76
PID 3012 wrote to memory of 3716	3012	cmd.exe	78
PID 3012 wrote to memory of 3716	3012	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe
"C:\Users\Admin\AppData\Local\Temp\e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c TIMEOUT /T 50 /NOBREAK && move "C:\Users\Admin\AppData\Local\Temp\jhhiaujgfq" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Control Panel.lnk"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\timeout.exe
    TIMEOUT /T 50 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-0-0x0000000000500000-0x0000000000533000-memory.dmp

Filesize
204KB

Download
memory/788-1-0x00000000020E0000-0x0000000002112000-memory.dmp

Filesize
200KB

Download