Analysis
- max time kernel
149s - max time network
148s - platform
windows10_x64 - resource
win10 - submitted
25/10/2020, 18:39
Static task
static1
Behavioral task
behavioral1
Sample
c2db19ca1c117b714c6ed25e2972d3eb.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c2db19ca1c117b714c6ed25e2972d3eb.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target c2db19ca1c117b714c6ed25e2972d3eb.exe
- Size 98KB
- Sample201025-7w98c129pe
- SHA256 b0aac0d798e9f2f747d38c7fb06d871dc418b3122f45c346d323b4375f37dbed
- MD5 c2db19ca1c117b714c6ed25e2972d3eb
- SHA1 1d514c8763804ee36b36feed4a22471328dd6316
- SHA512 f8f03e8c4d2bdbf9cc01294fe53a5853a392823c9902de7eacf49acfeb76aca4c2ca81927a900b929d76fb2dc9802cfd9b25207b73c4df2b088719cb05fda57e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3300 chargeable.exe 2800 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" c2db19ca1c117b714c6ed25e2972d3eb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c2db19ca1c117b714c6ed25e2972d3eb.exe" c2db19ca1c117b714c6ed25e2972d3eb.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3300 set thread context of 2800 3300 chargeable.exe 78 - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe Token: 33 2800 chargeable.exe Token: SeIncBasePriorityPrivilege 2800 chargeable.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3984 wrote to memory of 3300 3984 c2db19ca1c117b714c6ed25e2972d3eb.exe 77 PID 3984 wrote to memory of 3300 3984 c2db19ca1c117b714c6ed25e2972d3eb.exe 77 PID 3984 wrote to memory of 3300 3984 c2db19ca1c117b714c6ed25e2972d3eb.exe 77 PID 3300 wrote to memory of 2800 3300 chargeable.exe 78 PID 3300 wrote to memory of 2800 3300 chargeable.exe 78 PID 3300 wrote to memory of 2800 3300 chargeable.exe 78 PID 3300 wrote to memory of 2800 3300 chargeable.exe 78 PID 3300 wrote to memory of 2800 3300 chargeable.exe 78 PID 3300 wrote to memory of 2800 3300 chargeable.exe 78 PID 3300 wrote to memory of 2800 3300 chargeable.exe 78 PID 3300 wrote to memory of 2800 3300 chargeable.exe 78 PID 2800 wrote to memory of 3900 2800 chargeable.exe 79 PID 2800 wrote to memory of 3900 2800 chargeable.exe 79 PID 2800 wrote to memory of 3900 2800 chargeable.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2db19ca1c117b714c6ed25e2972d3eb.exe"C:\Users\Admin\AppData\Local\Temp\c2db19ca1c117b714c6ed25e2972d3eb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:3900
-
-
-