f3418e9ec01f4116a2ae079c709ee3c20455d66861951751474dbeb49ab75c26

Analysis

max time kernel
147s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order118030620.exe
Size 108KB
Sample201109-cmfag44fax
SHA256 f3418e9ec01f4116a2ae079c709ee3c20455d66861951751474dbeb49ab75c26
MD5 03d84c2efb63b002e4e3061ef2a37598
SHA1 e846b471970f9cec8018c1164ef1f170335ca60f
SHA512 f7901accbe622c42abb87ab36cd3d93269425791662cc3fac491cbab529bac8f6f4557e9dc9439ddd6242ccfb8063252e1a31936083cc80d5718ff571bc64ef1
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	RegAsm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\soranernesk = "C:\\Users\\Admin\\EXTEMPORAL\\ontolo.exe"	RegAsm.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
500	Order118030620.exe
204	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 500 set thread context of 204	500	Order118030620.exe	81

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
500	Order118030620.exe
500	Order118030620.exe
500	Order118030620.exe
500	Order118030620.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
500	Order118030620.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 992	500	Order118030620.exe	78
PID 500 wrote to memory of 992	500	Order118030620.exe	78
PID 500 wrote to memory of 992	500	Order118030620.exe	78
PID 500 wrote to memory of 2680	500	Order118030620.exe	79
PID 500 wrote to memory of 2680	500	Order118030620.exe	79
PID 500 wrote to memory of 2680	500	Order118030620.exe	79
PID 500 wrote to memory of 212	500	Order118030620.exe	80
PID 500 wrote to memory of 212	500	Order118030620.exe	80
PID 500 wrote to memory of 212	500	Order118030620.exe	80
PID 500 wrote to memory of 204	500	Order118030620.exe	81
PID 500 wrote to memory of 204	500	Order118030620.exe	81
PID 500 wrote to memory of 204	500	Order118030620.exe	81
PID 500 wrote to memory of 204	500	Order118030620.exe	81

C:\Users\Admin\AppData\Local\Temp\Order118030620.exe
"C:\Users\Admin\AppData\Local\Temp\Order118030620.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:500
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\Order118030620.exe"
  2⤵
  PID:992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\Order118030620.exe"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\Order118030620.exe"
  2⤵
  PID:212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\Order118030620.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-2-0x000000007FAF0000-0x000000007FEA1000-memory.dmp

Download