Analysis
- max time kernel
150s - max time network
143s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:49
Static task
static1
Behavioral task
behavioral1
Sample
5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe
- Size 204KB
- Sample201109-kd2zdc1w3e
- SHA256 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed
- MD5 236148e858e1a5889acc2ad4ebf9ac41
- SHA1 cbbf4113fd9d2e35d3d641bee9f8191e785c0a00
- SHA512 968dc8f6ebb807f37abb9100096f65767ad1e93a89ffbdb59a91fa809b3ddb3cca67a997c06afcd493d0b22e27e8bf210b546e9e98fa4da9cf556e0783d27784
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- ServiceHost packer 1 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/3592-5-0x0000000000993500-mapping.dmp servicehost - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelPowerAgent3 = "rundll32.exe shell32.dll, ShellExec_RunDLL C:\\PROGRA~3\\6f81ee3f.exe" svchost.exe - Checks for any installed AV software in registry 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Avira svchost.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\AVAST Software\Avast svchost.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Eset\Nod svchost.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4700 set thread context of 3592 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 74 - Suspicious behavior: EnumeratesProcesses 566 IoCs
pid Process 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe 3592 svchost.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 3592 svchost.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4700 wrote to memory of 3592 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 74 PID 4700 wrote to memory of 3592 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 74 PID 4700 wrote to memory of 3592 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 74 PID 4700 wrote to memory of 3592 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 74 PID 4700 wrote to memory of 4232 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 76 PID 4700 wrote to memory of 4232 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 76 PID 4700 wrote to memory of 4232 4700 5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe"C:\Users\Admin\AppData\Local\Temp\5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\svchost.exeC:\ProgramData\6f81ee3f.exe2⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3592
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\swvD36D.tmp.bat" "C:\Users\Admin\AppData\Local\Temp\5815d28898fb5bb4067575c1885cde3ee909543c8d176b5f8029cebf34d3e4ed.exe""2⤵PID:4232
-