Analysis
- max time kernel
38s - max time network
99s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe
- Size 2.4MB
- Sample201109-t9l2yadgex
- SHA256 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4
- MD5 342c3e76a7c4ed44f6459129359775de
- SHA1 354263bedefba504187b44414ef122e5144cddc7
- SHA512 bae863e7840576c9b893ee7e63d15772d750e4fb26639ca5f25c3aba794d3e4608eeb4f08ebcb2bf765cad766a5d9a7726d534bdfce633bc0506856986863b8c
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2208-3-0x0000000000400000-0x0000000000994000-memory.dmp vmprotect behavioral2/memory/2208-5-0x0000000000400000-0x0000000000994000-memory.dmp vmprotect - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2208 iscsicli.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1172 set thread context of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe 2208 iscsicli.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1172 wrote to memory of 424 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 76 PID 1172 wrote to memory of 424 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 76 PID 1172 wrote to memory of 424 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 76 PID 1172 wrote to memory of 3172 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 77 PID 1172 wrote to memory of 3172 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 77 PID 1172 wrote to memory of 3172 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 77 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78 PID 1172 wrote to memory of 2208 1172 950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe"C:\Users\Admin\AppData\Local\Temp\950dc12698f157604f4788b9702ac05a737486bd2facf5ad4afa22980bcc27d4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\iscsicli.exe"C:\Windows\SysWOW64\iscsicli.exe"2⤵PID:424
-
-
C:\Windows\SysWOW64\iscsicli.exe"C:\Windows\SysWOW64\iscsicli.exe"2⤵PID:3172
-
-
C:\Windows\SysWOW64\iscsicli.exe"C:\Windows\SysWOW64\iscsicli.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2208
-