e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e

Resubmissions

27-09-2020 00:33

200927-n2q2v3n43s 6

10-09-2020 08:49

200910-c8x1yrxskj 10

Analysis

max time kernel
130s
max time network
141s
platform
windows10_x64
resource
win10v200722
submitted
27-09-2020 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe
Size

379KB
MD5

9f00d78f2e8e4523773a264f85be1c02
SHA1

3c542144a7a03134060bd666206a106bcea95e5a
SHA256

e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e
SHA512

5760967703d0702d4c855b75c895a2432c809ca8f945f2a80914f21b3c8129c4bbf155bac4bb5fa6b03e868b3d33cfbe1b3321a7b438741cd62d1c3323d38928

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype Remote Control = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe"	e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3716 timeout.exe

pid	process
3716	timeout.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.execmd.exe

description	pid	process	target process
PID 788 wrote to memory of 3012	788	e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe	cmd.exe
PID 788 wrote to memory of 3012	788	e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe	cmd.exe
PID 3012 wrote to memory of 3716	3012	cmd.exe	timeout.exe
PID 3012 wrote to memory of 3716	3012	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe
"C:\Users\Admin\AppData\Local\Temp\e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SYSTEM32\cmd.exe
cmd /c TIMEOUT /T 50 /NOBREAK && move "C:\Users\Admin\AppData\Local\Temp\jhhiaujgfq" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Control Panel.lnk"
2⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\system32\timeout.exe
TIMEOUT /T 50 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:3716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jhhiaujgfq

Download Submit
memory/788-0-0x0000000000500000-0x0000000000533000-memory.dmp

Filesize
204KB

Download
memory/788-1-0x00000000020E0000-0x0000000002112000-memory.dmp

Filesize
200KB

Download
memory/3012-3-0x0000000000000000-mapping.dmp

Download
memory/3716-7-0x0000000000000000-mapping.dmp

Download