Analysis
- max time kernel
91s - max time network
144s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:13
General
- Target gunzipped.exe
- Size 192KB
- Sample201109-b64kwalc1n
- SHA256 3371cb1ea5c1990f19e0141454e418ba8e30d70c140d5f4cd3e797aa80a9bb9c
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\subfolder1\filename1.scr"C:\Users\Admin\AppData\Local\Temp\subfolder1\filename1.scr" /S3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\subfolder1\filename1.scr"C:\Users\Admin\AppData\Local\Temp\subfolder1\filename1.scr" /S4⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-