17b671d207ca3e6334ddcae8ce17f1317ccaf35e992fed85724313ee1919f519

Analysis

max time kernel
109s
max time network
125s
platform
windows10_x64
resource
win10
submitted
05/10/2020, 05:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06088e0e173c5ad432565c919d1f4083.exe
Size 566KB
Sample201005-6cbwczd11a
SHA256 17b671d207ca3e6334ddcae8ce17f1317ccaf35e992fed85724313ee1919f519
MD5 06088e0e173c5ad432565c919d1f4083
SHA1 47a71f50b6dc1776d93eef7463ae0defcc96ebd4
SHA512 c3c7534990a270e5d9a98a38c17e9036a4ff0f8d9b915b90139e686c08bf2f775e51deeef2e2c5205543b8895dcd00ac4fe58bfe37c7b577c2ba5f0ba84a527d
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2920 set thread context of 2560	2920	06088e0e173c5ad432565c919d1f4083.exe	79

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2920	06088e0e173c5ad432565c919d1f4083.exe
2920	06088e0e173c5ad432565c919d1f4083.exe
2920	06088e0e173c5ad432565c919d1f4083.exe
2920	06088e0e173c5ad432565c919d1f4083.exe
2920	06088e0e173c5ad432565c919d1f4083.exe
2920	06088e0e173c5ad432565c919d1f4083.exe
2560	06088e0e173c5ad432565c919d1f4083.exe
2560	06088e0e173c5ad432565c919d1f4083.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	06088e0e173c5ad432565c919d1f4083.exe
Token: SeDebugPrivilege	2560	06088e0e173c5ad432565c919d1f4083.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1664	2920	06088e0e173c5ad432565c919d1f4083.exe	76
PID 2920 wrote to memory of 1664	2920	06088e0e173c5ad432565c919d1f4083.exe	76
PID 2920 wrote to memory of 1664	2920	06088e0e173c5ad432565c919d1f4083.exe	76
PID 2920 wrote to memory of 2368	2920	06088e0e173c5ad432565c919d1f4083.exe	78
PID 2920 wrote to memory of 2368	2920	06088e0e173c5ad432565c919d1f4083.exe	78
PID 2920 wrote to memory of 2368	2920	06088e0e173c5ad432565c919d1f4083.exe	78
PID 2920 wrote to memory of 2560	2920	06088e0e173c5ad432565c919d1f4083.exe	79
PID 2920 wrote to memory of 2560	2920	06088e0e173c5ad432565c919d1f4083.exe	79
PID 2920 wrote to memory of 2560	2920	06088e0e173c5ad432565c919d1f4083.exe	79
PID 2920 wrote to memory of 2560	2920	06088e0e173c5ad432565c919d1f4083.exe	79
PID 2920 wrote to memory of 2560	2920	06088e0e173c5ad432565c919d1f4083.exe	79
PID 2920 wrote to memory of 2560	2920	06088e0e173c5ad432565c919d1f4083.exe	79
PID 2920 wrote to memory of 2560	2920	06088e0e173c5ad432565c919d1f4083.exe	79
PID 2920 wrote to memory of 2560	2920	06088e0e173c5ad432565c919d1f4083.exe	79

C:\Users\Admin\AppData\Local\Temp\06088e0e173c5ad432565c919d1f4083.exe
"C:\Users\Admin\AppData\Local\Temp\06088e0e173c5ad432565c919d1f4083.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SlEuECPiv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD72C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1664
- C:\Users\Admin\AppData\Local\Temp\06088e0e173c5ad432565c919d1f4083.exe
  "C:\Users\Admin\AppData\Local\Temp\06088e0e173c5ad432565c919d1f4083.exe"
  2⤵
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\06088e0e173c5ad432565c919d1f4083.exe
  "C:\Users\Admin\AppData\Local\Temp\06088e0e173c5ad432565c919d1f4083.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-27-0x00000000060A0000-0x00000000060A1000-memory.dmp

Download

memory/2560-26-0x0000000005800000-0x0000000005801000-memory.dmp

Download

memory/2560-21-0x0000000073980000-0x000000007406E000-memory.dmp

Download

memory/2560-18-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2920-5-0x0000000005A00000-0x0000000005A01000-memory.dmp

Download

memory/2920-15-0x0000000007670000-0x00000000076AB000-memory.dmp

Download

memory/2920-14-0x0000000007610000-0x0000000007661000-memory.dmp

Download

memory/2920-13-0x00000000089B0000-0x00000000091B0000-memory.dmp

Download

memory/2920-12-0x0000000005710000-0x0000000005711000-memory.dmp

Download

memory/2920-8-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Download

memory/2920-0-0x0000000073980000-0x000000007406E000-memory.dmp

Download

memory/2920-4-0x0000000005D60000-0x0000000005D61000-memory.dmp

Download

memory/2920-3-0x00000000056A0000-0x00000000056F2000-memory.dmp

Download

memory/2920-1-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download