Analysis
- max time kernel
142s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe
- Size 938KB
- Sample201109-hddpts2p6e
- SHA256 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146
- MD5 067877bbe378d0f48d12c691c2230f57
- SHA1 54879e0e2ec63efbbafc9d452b88f3fb5044426b
- SHA512 79138a2ce4e49555a79bc184c1aba1da43064cd152294f6558ae12333a81e5558d6e72f9175dc926c61c5a18c97ea4ca04d8f28b5e2f037627a58d6d9d54941f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
resource yara_rule behavioral2/memory/2092-4-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/2092-6-0x0000000000C80000-0x0000000000C96000-memory.dmp upx behavioral2/memory/2092-7-0x0000000000C80000-0x0000000000C96000-memory.dmp upx - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.exe c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Wine c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4696 set thread context of 2092 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 75 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4696 wrote to memory of 2092 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 75 PID 4696 wrote to memory of 2092 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 75 PID 4696 wrote to memory of 2092 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 75 PID 4696 wrote to memory of 2092 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 75 PID 4696 wrote to memory of 2092 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 75 PID 4696 wrote to memory of 2092 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 75 PID 4696 wrote to memory of 2092 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 75 PID 4696 wrote to memory of 2092 4696 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 75 PID 2092 wrote to memory of 480 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 76 PID 2092 wrote to memory of 480 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 76 PID 2092 wrote to memory of 480 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 76 PID 2092 wrote to memory of 4172 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 77 PID 2092 wrote to memory of 4172 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 77 PID 2092 wrote to memory of 4172 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 77 PID 2092 wrote to memory of 4152 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 78 PID 2092 wrote to memory of 4152 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 78 PID 2092 wrote to memory of 4152 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 78 PID 2092 wrote to memory of 4156 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 79 PID 2092 wrote to memory of 4156 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 79 PID 2092 wrote to memory of 4156 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 79 PID 2092 wrote to memory of 1644 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 80 PID 2092 wrote to memory of 1644 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 80 PID 2092 wrote to memory of 1644 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 80 PID 2092 wrote to memory of 1736 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 83 PID 2092 wrote to memory of 1736 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 83 PID 2092 wrote to memory of 1736 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 83 PID 2092 wrote to memory of 2576 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 84 PID 2092 wrote to memory of 2576 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 84 PID 2092 wrote to memory of 2576 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 84 PID 2092 wrote to memory of 564 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 86 PID 2092 wrote to memory of 564 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 86 PID 2092 wrote to memory of 564 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 86 PID 2092 wrote to memory of 500 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 87 PID 2092 wrote to memory of 500 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 87 PID 2092 wrote to memory of 500 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 87 PID 2092 wrote to memory of 560 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 88 PID 2092 wrote to memory of 560 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 88 PID 2092 wrote to memory of 560 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 88 PID 2092 wrote to memory of 640 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 89 PID 2092 wrote to memory of 640 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 89 PID 2092 wrote to memory of 640 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 89 PID 2092 wrote to memory of 4092 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 90 PID 2092 wrote to memory of 4092 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 90 PID 2092 wrote to memory of 4092 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 90 PID 2092 wrote to memory of 4064 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 91 PID 2092 wrote to memory of 4064 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 91 PID 2092 wrote to memory of 4064 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 91 PID 2092 wrote to memory of 4036 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 92 PID 2092 wrote to memory of 4036 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 92 PID 2092 wrote to memory of 4036 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 92 PID 2092 wrote to memory of 4040 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 93 PID 2092 wrote to memory of 4040 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 93 PID 2092 wrote to memory of 4040 2092 c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe"C:\Users\Admin\AppData\Local\Temp\c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe"1⤵
- Drops startup file
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe"C:\Users\Admin\AppData\Local\Temp\c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:480
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:4172
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:4152
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:4156
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:1644
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:1736
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:2576
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:564
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:500
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:560
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:640
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:4092
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:4064
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:4036
-
-
C:\Windows\SysWOW64\calc.execalc.exe3⤵PID:4040
-
-