Analysis
- max time kernel
151s - max time network
153s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:51
General
- Target 618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exe
- Size 379KB
- Sample201109-3ds8a6thqa
- SHA256 618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exe"C:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exe"C:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exe" /sc minute /mo 53⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exe" /sc minute /mo 13⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {F90C8275-749E-4C7C-B21C-4B90A843C1CB} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exeC:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exeC:\Users\Admin\AppData\Local\Temp\618f4050d767d0c8f835ec3fa9e46b85b9291062a2e381122852238fa84c95f7.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/240-86-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-127-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-6-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-8-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-10-0x0000000074720000-0x0000000074E0E000-memory.dmp
memory/240-13-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-14-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-17-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-23-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-22-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-24-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-25-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-26-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-27-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-21-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-28-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-20-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-29-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-30-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-32-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-33-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-31-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-34-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-36-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-35-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-18-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-19-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-37-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-38-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-40-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-39-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-41-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-42-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-43-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-44-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-45-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-46-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-47-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-48-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-15-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-16-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-50-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-51-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-52-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-53-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-54-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-49-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-56-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-57-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-58-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-59-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-60-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-61-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-62-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-63-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-55-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-65-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-66-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-67-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-68-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-69-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-70-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-71-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-64-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-73-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-72-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-74-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-75-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-76-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-77-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-78-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-79-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-80-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-81-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-82-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-83-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-84-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-85-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-9-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-87-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-89-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-91-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-92-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-93-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-94-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-90-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-95-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-96-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-98-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-97-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-99-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-101-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-102-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-104-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-103-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-100-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-106-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-105-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-108-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-107-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-109-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-110-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-111-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-112-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-113-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-114-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-116-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-117-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-118-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-119-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-120-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-121-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-122-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-123-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-115-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-124-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-125-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-88-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-133-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-134-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-135-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-132-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-131-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-130-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-129-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-128-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-126-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-136-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-137-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-138-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-139-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-140-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-141-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-142-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-143-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-144-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-145-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-146-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-147-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-148-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-149-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-150-0x0000000000400000-0x0000000000430000-memory.dmp
memory/240-151-0x0000000000400000-0x0000000000430000-memory.dmp
memory/788-0-0x00000000747A0000-0x0000000074E8E000-memory.dmp
memory/788-1-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/788-3-0x0000000000300000-0x000000000030F000-memory.dmp
memory/788-4-0x0000000000350000-0x0000000000352000-memory.dmp
memory/788-5-0x00000000004E0000-0x00000000004E2000-memory.dmp
memory/792-162-0x0000000074720000-0x0000000074E0E000-memory.dmp
memory/1692-157-0x0000000074720000-0x0000000074E0E000-memory.dmp