Analysis
- max time kernel
34s - max time network
33s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:49
Static task
static1
Behavioral task
behavioral1
Sample
26B3B259A11A12730118024375448157.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
26B3B259A11A12730118024375448157.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 26B3B259A11A12730118024375448157.bin.exe
- Size 716KB
- Sample201109-fbtxecflde
- SHA256 851f2df17ce8673bc0747d4ec64b2904b3749a5e9028acbc65db70613b3e5ad5
- MD5 26b3b259a11a12730118024375448157
- SHA1 e77edf8c3d8070a8473df1a509671c86e309c39b
- SHA512 63192acd6f03d51ee72e227c7f98e7b12e6593b0604574f7a7b602600ed121719b03da94f65e0fcc9430019ea5c4be7c04fddb46e717608c63e374e0562ebaed
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 1660 SQLservras.exe 1664 SQLservras.exe 2008 SQLservras.exe 436 SQLservras.exe -
resource yara_rule behavioral1/memory/1796-4-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/files/0x00040000000130d7-6.dat upx behavioral1/files/0x00040000000130d7-9.dat upx behavioral1/files/0x00040000000130d7-8.dat upx behavioral1/files/0x00040000000130d7-10.dat upx behavioral1/files/0x00040000000130d7-11.dat upx behavioral1/files/0x00040000000130d7-14.dat upx behavioral1/files/0x00040000000130d7-16.dat upx behavioral1/memory/1664-18-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/files/0x00040000000130d7-20.dat upx behavioral1/files/0x00040000000130d7-21.dat upx behavioral1/files/0x00040000000130d7-22.dat upx behavioral1/files/0x00040000000130d7-25.dat upx behavioral1/files/0x00040000000130d7-27.dat upx behavioral1/memory/436-29-0x0000000010000000-0x0000000010362000-memory.dmp upx - Deletes itself 1 IoCs
pid Process 436 SQLservras.exe - Loads dropped DLL 7 IoCs
pid Process 1796 26B3B259A11A12730118024375448157.bin.exe 1660 SQLservras.exe 1660 SQLservras.exe 1664 SQLservras.exe 2008 SQLservras.exe 2008 SQLservras.exe 436 SQLservras.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SQLservras.exe - Modifies service 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSSQLSERVER SQL Server 26B3B259A11A12730118024375448157.bin.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSSQLSERVER SQL Server\DeleteFiles = "C:\\Users\\Admin\\AppData\\Local\\Temp\\26B3B259A11A12730118024375448157.bin.exe" 26B3B259A11A12730118024375448157.bin.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSSQLSERVER SQL Server SQLservras.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSSQLSERVER SQL Server\ConnectGroup = "0410" SQLservras.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSSQLSERVER SQL Server SQLservras.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSSQLSERVER SQL Server\MarkTime = "2020-11-11 01:42" SQLservras.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2036 set thread context of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 1660 set thread context of 1664 1660 SQLservras.exe 31 PID 2008 set thread context of 436 2008 SQLservras.exe 33 - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe 26B3B259A11A12730118024375448157.bin.exe File created C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe 26B3B259A11A12730118024375448157.bin.exe - Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLservras.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLservras.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLservras.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLservras.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLservras.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77 SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" SQLservras.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 SQLservras.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1" SQLservras.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings SQLservras.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad SQLservras.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD} SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" SQLservras.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070051000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" SQLservras.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLservras.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLservras.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = 1048290bccb7d601 SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0" SQLservras.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings SQLservras.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SQLservras.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 SQLservras.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLservras.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network" SQLservras.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" SQLservras.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 1048290bccb7d601 SQLservras.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1796 26B3B259A11A12730118024375448157.bin.exe Token: SeDebugPrivilege 1664 SQLservras.exe Token: SeDebugPrivilege 436 SQLservras.exe Token: SeDebugPrivilege 436 SQLservras.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 2036 wrote to memory of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 2036 wrote to memory of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 2036 wrote to memory of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 2036 wrote to memory of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 2036 wrote to memory of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 2036 wrote to memory of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 2036 wrote to memory of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 2036 wrote to memory of 1796 2036 26B3B259A11A12730118024375448157.bin.exe 29 PID 1796 wrote to memory of 1660 1796 26B3B259A11A12730118024375448157.bin.exe 30 PID 1796 wrote to memory of 1660 1796 26B3B259A11A12730118024375448157.bin.exe 30 PID 1796 wrote to memory of 1660 1796 26B3B259A11A12730118024375448157.bin.exe 30 PID 1796 wrote to memory of 1660 1796 26B3B259A11A12730118024375448157.bin.exe 30 PID 1796 wrote to memory of 1660 1796 26B3B259A11A12730118024375448157.bin.exe 30 PID 1796 wrote to memory of 1660 1796 26B3B259A11A12730118024375448157.bin.exe 30 PID 1796 wrote to memory of 1660 1796 26B3B259A11A12730118024375448157.bin.exe 30 PID 1660 wrote to memory of 1664 1660 SQLservras.exe 31 PID 1660 wrote to memory of 1664 1660 SQLservras.exe 31 PID 1660 wrote to memory of 1664 1660 SQLservras.exe 31 PID 1660 wrote to memory of 1664 1660 SQLservras.exe 31 PID 1660 wrote to memory of 1664 1660 SQLservras.exe 31 PID 1660 wrote to memory of 1664 1660 SQLservras.exe 31 PID 1660 wrote to memory of 1664 1660 SQLservras.exe 31 PID 1660 wrote to memory of 1664 1660 SQLservras.exe 31 PID 1660 wrote to memory of 1664 1660 SQLservras.exe 31 PID 2008 wrote to memory of 436 2008 SQLservras.exe 33 PID 2008 wrote to memory of 436 2008 SQLservras.exe 33 PID 2008 wrote to memory of 436 2008 SQLservras.exe 33 PID 2008 wrote to memory of 436 2008 SQLservras.exe 33 PID 2008 wrote to memory of 436 2008 SQLservras.exe 33 PID 2008 wrote to memory of 436 2008 SQLservras.exe 33 PID 2008 wrote to memory of 436 2008 SQLservras.exe 33 PID 2008 wrote to memory of 436 2008 SQLservras.exe 33 PID 2008 wrote to memory of 436 2008 SQLservras.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\26B3B259A11A12730118024375448157.bin.exe"C:\Users\Admin\AppData\Local\Temp\26B3B259A11A12730118024375448157.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\26B3B259A11A12730118024375448157.bin.exe2⤵
- Loads dropped DLL
- Modifies service
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
-
-
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe2⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
- Modifies service
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:436
-