bee17c10f6ae2b3d19cc7cdd1e54f11a9aac44cda0b5d6f41c0dbdce69b79ad5

Analysis

max time kernel
63s
max time network
152s
platform
windows10_x64
resource
win10
submitted
13/10/2020, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96d47df84fe322875b17d2c824b314c9.exe
Size 890KB
Sample201013-l5vy4jthw2
SHA256 bee17c10f6ae2b3d19cc7cdd1e54f11a9aac44cda0b5d6f41c0dbdce69b79ad5
MD5 96d47df84fe322875b17d2c824b314c9
SHA1 b039d4e70b8268c8e62bfc64791a31d1ceb6bfea
SHA512 89fbda808cef44c528c96f73a45e4c1d30feb88f5c023258c720a9254daad15975c7d7cd8fe5b0a7076b0735392339930ac4e655c1cc0e5089b4934188bbaa42
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2640	dbcdo.pif
3332	RegSvcs.exe
4000	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 3332	2640	dbcdo.pif	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3768	3332	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif
2640	dbcdo.pif

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2640	3060	96d47df84fe322875b17d2c824b314c9.exe	73
PID 3060 wrote to memory of 2640	3060	96d47df84fe322875b17d2c824b314c9.exe	73
PID 3060 wrote to memory of 2640	3060	96d47df84fe322875b17d2c824b314c9.exe	73
PID 2640 wrote to memory of 2136	2640	dbcdo.pif	78
PID 2640 wrote to memory of 2136	2640	dbcdo.pif	78
PID 2640 wrote to memory of 2136	2640	dbcdo.pif	78
PID 2640 wrote to memory of 2184	2640	dbcdo.pif	79
PID 2640 wrote to memory of 2184	2640	dbcdo.pif	79
PID 2640 wrote to memory of 2184	2640	dbcdo.pif	79
PID 2640 wrote to memory of 2672	2640	dbcdo.pif	80
PID 2640 wrote to memory of 2672	2640	dbcdo.pif	80
PID 2640 wrote to memory of 2672	2640	dbcdo.pif	80
PID 2640 wrote to memory of 2820	2640	dbcdo.pif	81
PID 2640 wrote to memory of 2820	2640	dbcdo.pif	81
PID 2640 wrote to memory of 2820	2640	dbcdo.pif	81
PID 2640 wrote to memory of 4052	2640	dbcdo.pif	82
PID 2640 wrote to memory of 4052	2640	dbcdo.pif	82
PID 2640 wrote to memory of 4052	2640	dbcdo.pif	82
PID 2640 wrote to memory of 3692	2640	dbcdo.pif	83
PID 2640 wrote to memory of 3692	2640	dbcdo.pif	83
PID 2640 wrote to memory of 3692	2640	dbcdo.pif	83
PID 2640 wrote to memory of 4008	2640	dbcdo.pif	84
PID 2640 wrote to memory of 4008	2640	dbcdo.pif	84
PID 2640 wrote to memory of 4008	2640	dbcdo.pif	84
PID 2640 wrote to memory of 4000	2640	dbcdo.pif	85
PID 2640 wrote to memory of 4000	2640	dbcdo.pif	85
PID 2640 wrote to memory of 4000	2640	dbcdo.pif	85
PID 2640 wrote to memory of 3332	2640	dbcdo.pif	86
PID 2640 wrote to memory of 3332	2640	dbcdo.pif	86
PID 2640 wrote to memory of 3332	2640	dbcdo.pif	86
PID 2640 wrote to memory of 3332	2640	dbcdo.pif	86

C:\Users\Admin\AppData\Local\Temp\96d47df84fe322875b17d2c824b314c9.exe
"C:\Users\Admin\AppData\Local\Temp\96d47df84fe322875b17d2c824b314c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\50811080\dbcdo.pif
  "C:\50811080\dbcdo.pif" dfupi.jgi
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
    3⤵
    - Executes dropped EXE
    PID:4000
- - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
    3⤵
    - Executes dropped EXE
    PID:3332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 88
      4⤵
      Program crash
      PID:3768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-3-0x0000000073120000-0x00000000731B3000-memory.dmp

Download

memory/3768-18-0x0000000004590000-0x0000000004591000-memory.dmp

Download