Analysis
- max time kernel
140s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe
- Size 938KB
- Sample201109-dev6phhchx
- SHA256 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d
- MD5 c59fe051332fdb1e97e7e804f5bf7823
- SHA1 db5a236ee9abcc089d90e6aef13c8b9d7c3cb677
- SHA512 408dee8cf804aad41ad0d1013a8dbc052708861b22d6ba08922da541ed2e52e9362b90932e7fe133bd967bed5a54567c87ae4976eea7a177378852a6d366a9ae
- MD5 SHA1 SHA512
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
resource yara_rule behavioral2/memory/2104-4-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/2104-6-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/2104-7-0x0000000000C80000-0x0000000000C96000-memory.dmp upx - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Wine 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4040 set thread context of 2104 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 75 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4040 wrote to memory of 2104 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 75 PID 4040 wrote to memory of 2104 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 75 PID 4040 wrote to memory of 2104 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 75 PID 4040 wrote to memory of 2104 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 75 PID 4040 wrote to memory of 2104 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 75 PID 4040 wrote to memory of 2104 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 75 PID 4040 wrote to memory of 2104 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 75 PID 4040 wrote to memory of 2104 4040 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 75 PID 2104 wrote to memory of 200 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 76 PID 2104 wrote to memory of 200 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 76 PID 2104 wrote to memory of 200 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 76 PID 2104 wrote to memory of 1544 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 77 PID 2104 wrote to memory of 1544 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 77 PID 2104 wrote to memory of 1544 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 77 PID 2104 wrote to memory of 932 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 78 PID 2104 wrote to memory of 932 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 78 PID 2104 wrote to memory of 932 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 78 PID 2104 wrote to memory of 1984 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 79 PID 2104 wrote to memory of 1984 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 79 PID 2104 wrote to memory of 1984 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 79 PID 2104 wrote to memory of 1352 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 80 PID 2104 wrote to memory of 1352 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 80 PID 2104 wrote to memory of 1352 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 80 PID 2104 wrote to memory of 3796 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 83 PID 2104 wrote to memory of 3796 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 83 PID 2104 wrote to memory of 3796 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 83 PID 2104 wrote to memory of 1172 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 84 PID 2104 wrote to memory of 1172 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 84 PID 2104 wrote to memory of 1172 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 84 PID 2104 wrote to memory of 4036 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 86 PID 2104 wrote to memory of 4036 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 86 PID 2104 wrote to memory of 4036 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 86 PID 2104 wrote to memory of 2072 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 87 PID 2104 wrote to memory of 2072 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 87 PID 2104 wrote to memory of 2072 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 87 PID 2104 wrote to memory of 2652 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 88 PID 2104 wrote to memory of 2652 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 88 PID 2104 wrote to memory of 2652 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 88 PID 2104 wrote to memory of 3628 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 89 PID 2104 wrote to memory of 3628 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 89 PID 2104 wrote to memory of 3628 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 89 PID 2104 wrote to memory of 3400 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 90 PID 2104 wrote to memory of 3400 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 90 PID 2104 wrote to memory of 3400 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 90 PID 2104 wrote to memory of 3892 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 91 PID 2104 wrote to memory of 3892 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 91 PID 2104 wrote to memory of 3892 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 91 PID 2104 wrote to memory of 3912 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 92 PID 2104 wrote to memory of 3912 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 92 PID 2104 wrote to memory of 3912 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 92 PID 2104 wrote to memory of 3936 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 93 PID 2104 wrote to memory of 3936 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 93 PID 2104 wrote to memory of 3936 2104 751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe"C:\Users\Admin\AppData\Local\Temp\751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe"1⤵
- Drops startup file
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe"C:\Users\Admin\AppData\Local\Temp\751ee638a513e32eb5d9c9ce48b7f5dcc9eebab17dd328ba5820bc5813e1f85d.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:200
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:1544
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:932
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:1984
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:1352
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:3796
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:1172
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:4036
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:2072
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:2652
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:3628
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:3400
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:3892
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:3912
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:3936
-
-