Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:25
Static task
static1
Behavioral task
behavioral1
Sample
dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe
- Size 355KB
- Sample201109-xbj2krd3f2
- SHA256 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc
- MD5 3ce7f45f3e96898bf0de39c7f3caa10d
- SHA1 c95728a1d158703fbf7bbc654f727e047d0c7be0
- SHA512 f8262fef9716d2eb6625e6520d2b0457cfdff55acd4cd4c291ebabfbece313ec4fce4ee8ecc08a1aee0861b5828fc6ca73ab68f0d688e21baabd12535f228072
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe - Executes dropped EXE 1 IoCs
pid Process 3548 svchost.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c366616 = "Fˆ·LjÚÇ\x10:¦‘d؎ʇ±" dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c366616 = "Fˆ·LjÚÇ\x10:¦‘d؎ʇ±" svchost.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe File opened for modification C:\Windows\apppatch\svchost.exe dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe - Suspicious behavior: EnumeratesProcesses 298 IoCs
pid Process 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe 3548 svchost.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1048 wrote to memory of 3548 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 76 PID 1048 wrote to memory of 3548 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 76 PID 1048 wrote to memory of 3548 1048 dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe"C:\Users\Admin\AppData\Local\Temp\dadd0d7d480d15bb718d82ff012ace97f16fb4a2a6862dc5ad04e9b2b95380cc.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:3548
-