Analysis
- max time kernel
93s - max time network
30s - platform
windows7_x64 - resource
win7v20201028 - submitted
08/11/2020, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe
- Size 853KB
- Sample201108-55cspc9aws
- SHA256 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f
- MD5 13820d979e444b1442ff6e657e383176
- SHA1 5967f2ef3a06a96ea13201ea72da6a2b277b0986
- SHA512 d274b9f87910c7971ef51b8c047e3e3453c418b9c9152adebf4f7066f4aafa013561cec5ec1e21ab95f3217f30513a92e51af34f9ef692b9dffca9a79699f543
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe - Modifies Installed Components in the registry 2 TTPs
- Deletes itself 1 IoCs
pid Process 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe - Loads dropped DLL 1 IoCs
pid Process 1804 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\trkcore = "C:\\ProgramData\\Microsoft\\Roaming\\svchost.exe" 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1568 explorer.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1804 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeShutdownPrivilege 1568 explorer.exe Token: SeShutdownPrivilege 1568 explorer.exe Token: SeShutdownPrivilege 1568 explorer.exe Token: SeShutdownPrivilege 1568 explorer.exe Token: SeShutdownPrivilege 1568 explorer.exe Token: SeShutdownPrivilege 1568 explorer.exe Token: SeShutdownPrivilege 1568 explorer.exe Token: SeShutdownPrivilege 1568 explorer.exe Token: SeShutdownPrivilege 1568 explorer.exe Token: 33 296 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 296 AUDIODG.EXE Token: 33 296 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 296 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe - Suspicious use of SendNotifyMessage 26 IoCs
pid Process 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe 1568 explorer.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2004 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2004 1804 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 26 PID 1804 wrote to memory of 2004 1804 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 26 PID 1804 wrote to memory of 2004 1804 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 26 PID 1804 wrote to memory of 2004 1804 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe 26 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe"C:\Users\Admin\AppData\Local\Temp\9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exeC:\Users\Admin\AppData\Local\Temp\9ea59a3284eb0dfd4af9a58e5e5be9abf46cd42e911650f587c7d6d67d29691f.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
PID:2004
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies service
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1568
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1452
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4441⤵
- Suspicious use of AdjustPrivilegeToken
PID:296