Analysis
- max time kernel
51s - max time network
114s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/11/2020, 18:24
Static task
static1
Behavioral task
behavioral1
Sample
2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe
- Size 208KB
- Sample201108-wtce6s3pqs
- SHA256 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1
- MD5 6308c3ebedfb83eee797f3bb9e9ec470
- SHA1 71aabe6a2cd169682b05b66e18ee53ea4b26d789
- SHA512 bff3592bc5717fe72a0e9a1d01e966ffaf7c6ffcd70ba64387cbbe82c4bf9d1891562d5d90ed27e19cfb4453ed7ccf6b536508aeb40d29b0cd2d7bbc31e72a98
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
description pid Process procid_target PID 3748 created 4700 3748 WerFault.exe 67 PID 4156 created 3500 4156 WerFault.exe 78 PID 4336 created 4340 4336 WerFault.exe 83 - ServiceHost packer 12 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/3500-13-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3500-12-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3500-16-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3500-18-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3500-19-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3500-20-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3500-21-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3500-22-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3500-23-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4340-26-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4340-27-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/4340-28-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 3500 ZXVTS.exe 4340 RQRLGP.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\windows\SysWOW64\RQRLGP.exe ZXVTS.exe File opened for modification C:\windows\SysWOW64\RQRLGP.exe ZXVTS.exe File created C:\windows\SysWOW64\RQRLGP.exe.bat ZXVTS.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\windows\system\ZXVTS.exe 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe File opened for modification C:\windows\system\ZXVTS.exe 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe File created C:\windows\system\ZXVTS.exe.bat 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe - Program crash 3 IoCs
pid pid_target Process procid_target 3748 4700 WerFault.exe 67 4156 3500 WerFault.exe 78 4336 4340 WerFault.exe 83 - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 4700 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe 4700 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3748 WerFault.exe 3500 ZXVTS.exe 3500 ZXVTS.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4340 RQRLGP.exe 4340 RQRLGP.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe 4336 WerFault.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 3748 WerFault.exe Token: SeBackupPrivilege 3748 WerFault.exe Token: SeDebugPrivilege 3748 WerFault.exe Token: SeDebugPrivilege 4156 WerFault.exe Token: SeDebugPrivilege 4336 WerFault.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4700 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe 4700 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe 3500 ZXVTS.exe 3500 ZXVTS.exe 4340 RQRLGP.exe 4340 RQRLGP.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4700 wrote to memory of 4128 4700 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe 74 PID 4700 wrote to memory of 4128 4700 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe 74 PID 4700 wrote to memory of 4128 4700 2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe 74 PID 4128 wrote to memory of 3500 4128 cmd.exe 78 PID 4128 wrote to memory of 3500 4128 cmd.exe 78 PID 4128 wrote to memory of 3500 4128 cmd.exe 78 PID 3500 wrote to memory of 4168 3500 ZXVTS.exe 80 PID 3500 wrote to memory of 4168 3500 ZXVTS.exe 80 PID 3500 wrote to memory of 4168 3500 ZXVTS.exe 80 PID 4168 wrote to memory of 4340 4168 cmd.exe 83 PID 4168 wrote to memory of 4340 4168 cmd.exe 83 PID 4168 wrote to memory of 4340 4168 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe"C:\Users\Admin\AppData\Local\Temp\2e93116e3d1711bdb935538502d6dd229e13e16bc8ef555a71289a150aed17e1.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXVTS.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\system\ZXVTS.exeC:\windows\system\ZXVTS.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQRLGP.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\SysWOW64\RQRLGP.exeC:\windows\system32\RQRLGP.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 7806⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 8724⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 11562⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748
-