Analysis
- max time kernel
148s - max time network
153s - platform
windows10_x64 - resource
win10 - submitted
10/10/2020, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
fc72ab34d865089f137f44792dc72487.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fc72ab34d865089f137f44792dc72487.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target fc72ab34d865089f137f44792dc72487.exe
- Size 5.8MB
- Sample201010-jeqycdmtaj
- SHA256 7eed0a7abb529f2d7208babe7ab96ea673878fad3fcd7779340b4d6dc3d8468e
- MD5 fc72ab34d865089f137f44792dc72487
- SHA1 cc6a630f58de4d50f347e4e99f372ba6b8b912b9
- SHA512 d9ab0c88e1084f4bdd7b1942f537fb3d7132e99389bd82fc41fae404e427908346b796b607db01e9a305e399d578adcdb344394b06c90b7871a9dc4995b11387
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1084 dllhost.exe -
resource yara_rule behavioral2/files/0x000100000001adae-1.dat upx behavioral2/files/0x000100000001adae-2.dat upx behavioral2/files/0x000100000001ada8-3.dat upx behavioral2/files/0x000100000001ada9-4.dat upx behavioral2/files/0x000100000001adac-6.dat upx behavioral2/files/0x000100000001adab-5.dat upx behavioral2/files/0x000100000001ada9-7.dat upx behavioral2/files/0x000100000001adaf-8.dat upx behavioral2/files/0x000100000001adac-9.dat upx behavioral2/files/0x000100000001adaa-10.dat upx behavioral2/files/0x000100000001adaf-11.dat upx behavioral2/files/0x000100000001adad-12.dat upx behavioral2/files/0x000100000001adab-13.dat upx behavioral2/files/0x000100000001adad-14.dat upx behavioral2/files/0x000100000001ada8-15.dat upx behavioral2/files/0x000100000001ada8-16.dat upx behavioral2/files/0x000100000001adaa-17.dat upx behavioral2/memory/1084-18-0x0000000072C90000-0x0000000072D18000-memory.dmp upx - Loads dropped DLL 8 IoCs
pid Process 1084 dllhost.exe 1084 dllhost.exe 1084 dllhost.exe 1084 dllhost.exe 1084 dllhost.exe 1084 dllhost.exe 1084 dllhost.exe 1084 dllhost.exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 26 myexternalip.com 20 myexternalip.com 21 myexternalip.com - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 3608 fc72ab34d865089f137f44792dc72487.exe 3608 fc72ab34d865089f137f44792dc72487.exe 3608 fc72ab34d865089f137f44792dc72487.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 3608 fc72ab34d865089f137f44792dc72487.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3608 fc72ab34d865089f137f44792dc72487.exe 3608 fc72ab34d865089f137f44792dc72487.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3608 wrote to memory of 1084 3608 fc72ab34d865089f137f44792dc72487.exe 75 PID 3608 wrote to memory of 1084 3608 fc72ab34d865089f137f44792dc72487.exe 75 PID 3608 wrote to memory of 1084 3608 fc72ab34d865089f137f44792dc72487.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc72ab34d865089f137f44792dc72487.exe"C:\Users\Admin\AppData\Local\Temp\fc72ab34d865089f137f44792dc72487.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\f68aa103\tor\dllhost.exe"C:\Users\Admin\AppData\Local\f68aa103\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084
-