Analysis
- max time kernel
149s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:49
Static task
static1
Behavioral task
behavioral1
Sample
26B3B259A11A12730118024375448157.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
26B3B259A11A12730118024375448157.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 26B3B259A11A12730118024375448157.bin.exe
- Size 716KB
- Sample201109-fbtxecflde
- SHA256 851f2df17ce8673bc0747d4ec64b2904b3749a5e9028acbc65db70613b3e5ad5
- MD5 26b3b259a11a12730118024375448157
- SHA1 e77edf8c3d8070a8473df1a509671c86e309c39b
- SHA512 63192acd6f03d51ee72e227c7f98e7b12e6593b0604574f7a7b602600ed121719b03da94f65e0fcc9430019ea5c4be7c04fddb46e717608c63e374e0562ebaed
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 196 SQLservras.exe 1864 SQLservras.exe 2624 SQLservras.exe 2464 SQLservras.exe -
resource yara_rule behavioral2/memory/912-4-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral2/files/0x000200000001ab88-7.dat upx behavioral2/files/0x000200000001ab88-8.dat upx behavioral2/files/0x000200000001ab88-11.dat upx behavioral2/files/0x000200000001ab88-16.dat upx behavioral2/files/0x000200000001ab88-19.dat upx - Deletes itself 1 IoCs
pid Process 2464 SQLservras.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat SQLservras.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLservras.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLservras.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLservras.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLservras.exe - Modifies service 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSSQLSERVER SQL Server SQLservras.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSSQLSERVER SQL Server\ConnectGroup = "0410" SQLservras.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSSQLSERVER SQL Server SQLservras.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSSQLSERVER SQL Server\MarkTime = "2020-11-11 01:43" SQLservras.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSSQLSERVER SQL Server 26B3B259A11A12730118024375448157.bin.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSSQLSERVER SQL Server\DeleteFiles = "C:\\Users\\Admin\\AppData\\Local\\Temp\\26B3B259A11A12730118024375448157.bin.exe" 26B3B259A11A12730118024375448157.bin.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1304 set thread context of 912 1304 26B3B259A11A12730118024375448157.bin.exe 75 PID 196 set thread context of 1864 196 SQLservras.exe 77 PID 2624 set thread context of 2464 2624 SQLservras.exe 79 - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe 26B3B259A11A12730118024375448157.bin.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe 26B3B259A11A12730118024375448157.bin.exe - Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLservras.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLservras.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLservras.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLservras.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLservras.exe - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLservras.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLservras.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLservras.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLservras.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLservras.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 912 26B3B259A11A12730118024375448157.bin.exe Token: SeDebugPrivilege 1864 SQLservras.exe Token: SeDebugPrivilege 2464 SQLservras.exe Token: SeDebugPrivilege 2464 SQLservras.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1304 wrote to memory of 912 1304 26B3B259A11A12730118024375448157.bin.exe 75 PID 1304 wrote to memory of 912 1304 26B3B259A11A12730118024375448157.bin.exe 75 PID 1304 wrote to memory of 912 1304 26B3B259A11A12730118024375448157.bin.exe 75 PID 1304 wrote to memory of 912 1304 26B3B259A11A12730118024375448157.bin.exe 75 PID 1304 wrote to memory of 912 1304 26B3B259A11A12730118024375448157.bin.exe 75 PID 912 wrote to memory of 196 912 26B3B259A11A12730118024375448157.bin.exe 76 PID 912 wrote to memory of 196 912 26B3B259A11A12730118024375448157.bin.exe 76 PID 912 wrote to memory of 196 912 26B3B259A11A12730118024375448157.bin.exe 76 PID 196 wrote to memory of 1864 196 SQLservras.exe 77 PID 196 wrote to memory of 1864 196 SQLservras.exe 77 PID 196 wrote to memory of 1864 196 SQLservras.exe 77 PID 196 wrote to memory of 1864 196 SQLservras.exe 77 PID 196 wrote to memory of 1864 196 SQLservras.exe 77 PID 2624 wrote to memory of 2464 2624 SQLservras.exe 79 PID 2624 wrote to memory of 2464 2624 SQLservras.exe 79 PID 2624 wrote to memory of 2464 2624 SQLservras.exe 79 PID 2624 wrote to memory of 2464 2624 SQLservras.exe 79 PID 2624 wrote to memory of 2464 2624 SQLservras.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\26B3B259A11A12730118024375448157.bin.exe"C:\Users\Admin\AppData\Local\Temp\26B3B259A11A12730118024375448157.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\26B3B259A11A12730118024375448157.bin.exe2⤵
- Modifies service
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe4⤵
- Executes dropped EXE
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
-
-
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe2⤵
- Executes dropped EXE
- Deletes itself
- Drops file in System32 directory
- Modifies service
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2464
-