Analysis
- max time kernel
89s - max time network
27s - platform
windows7_x64 - resource
win7v20201028 - submitted
08/11/2020, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe
- Size 768KB
- Sample201108-vav862br8a
- SHA256 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2
- MD5 51361fbe8c81449acf395d2b29d13a4e
- SHA1 78ff64fe0c75cd6f788f7d6a81c95c501f387f66
- SHA512 1f77c91480306048ebec6aa643aee4e6cf902a2c2415ed597640656c57174c803b33f891378c2f4e2bbd28d29ea980ac6d57e9467b605a5ed5d48fbb7e5144e7
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Modifies Installed Components in the registry 2 TTPs
- Deletes itself 1 IoCs
pid Process 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Loads dropped DLL 1 IoCs
pid Process 740 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\trkcore = "C:\\ProgramData\\Microsoft\\Roaming\\svchost.exe" bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1196 explorer.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 740 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeShutdownPrivilege 1196 explorer.exe Token: SeShutdownPrivilege 1196 explorer.exe Token: SeShutdownPrivilege 1196 explorer.exe Token: SeShutdownPrivilege 1196 explorer.exe Token: SeShutdownPrivilege 1196 explorer.exe Token: SeShutdownPrivilege 1196 explorer.exe Token: SeShutdownPrivilege 1196 explorer.exe Token: 33 860 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 860 AUDIODG.EXE Token: 33 860 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 860 AUDIODG.EXE Token: SeShutdownPrivilege 1196 explorer.exe Token: SeShutdownPrivilege 1196 explorer.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe - Suspicious use of SendNotifyMessage 26 IoCs
pid Process 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe 1196 explorer.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2012 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 740 wrote to memory of 2012 740 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 27 PID 740 wrote to memory of 2012 740 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 27 PID 740 wrote to memory of 2012 740 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 27 PID 740 wrote to memory of 2012 740 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 27 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe"C:\Users\Admin\AppData\Local\Temp\bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exeC:\Users\Admin\AppData\Local\Temp\bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
PID:2012
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1552
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies service
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1196
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc41⤵
- Suspicious use of AdjustPrivilegeToken
PID:860