Analysis
- max time kernel
147s - max time network
142s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe
- Size 220KB
- Sample201110-894fvy58l6
- SHA256 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb
- MD5 30dc5fff6bd34f9afebb83909f0f019e
- SHA1 3992554a1b8c9e23d8093a028dbc52cbdde660cd
- SHA512 deb335fc95cc05bc8b263c7191222cb3ebf5d46b08ae2edbd438cc7caf76c0ac002bc6cca92adb39215e7c20ed08ab609a8cc19166d5ae5c85e114a990d0841c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\resmon32.exe" resmon32.exe - Executes dropped EXE 3 IoCs
pid Process 1632 resmon32.exe 1776 resmon32.exe 1800 resmon32.exe - Deletes itself 1 IoCs
pid Process 1772 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*resmon32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe" 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\resmon32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe" 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 resmon32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132494858841863216" resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage resmon32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage resmon32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 resmon32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 resmon32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage resmon32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 resmon32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 resmon32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage resmon32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage resmon32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance resmon32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage resmon32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage resmon32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 432 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1268 timeout.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe 1632 resmon32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1632 resmon32.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 548 wrote to memory of 1632 548 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe 27 PID 548 wrote to memory of 1632 548 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe 27 PID 548 wrote to memory of 1632 548 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe 27 PID 548 wrote to memory of 1728 548 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe 28 PID 548 wrote to memory of 1728 548 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe 28 PID 548 wrote to memory of 1728 548 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe 28 PID 548 wrote to memory of 1772 548 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe 29 PID 548 wrote to memory of 1772 548 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe 29 PID 548 wrote to memory of 1772 548 92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe 29 PID 1772 wrote to memory of 1268 1772 cmd.exe 34 PID 1772 wrote to memory of 1268 1772 cmd.exe 34 PID 1772 wrote to memory of 1268 1772 cmd.exe 34 PID 1632 wrote to memory of 432 1632 resmon32.exe 35 PID 1632 wrote to memory of 432 1632 resmon32.exe 35 PID 1632 wrote to memory of 432 1632 resmon32.exe 35 PID 528 wrote to memory of 1776 528 taskeng.exe 40 PID 528 wrote to memory of 1776 528 taskeng.exe 40 PID 528 wrote to memory of 1776 528 taskeng.exe 40 PID 528 wrote to memory of 1800 528 taskeng.exe 41 PID 528 wrote to memory of 1800 528 taskeng.exe 41 PID 528 wrote to memory of 1800 528 taskeng.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe"C:\Users\Admin\AppData\Local\Temp\92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\resmon32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\resmon32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\resmon32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1728
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe" && del "C:\Users\Admin\AppData\Local\Temp\92e202cf535ab9a1ed4d04555623a772e06e99f9c64842c0110c4e3cb93d97fb.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1268
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1580
-
C:\Windows\system32\taskeng.exetaskeng.exe {A4F02182-0148-48C8-BDB4-9339BBF6FFD9} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\resmon32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\resmon32.exe arguments2⤵
- Executes dropped EXE
PID:1776
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\resmon32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\resmon32.exe arguments2⤵
- Executes dropped EXE
PID:1800
-