Analysis
- max time kernel
150s - max time network
144s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:00
Static task
static1
Behavioral task
behavioral1
Sample
74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe
- Size 220KB
- Sample201110-bmbgfbs3t6
- SHA256 74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768
- MD5 ef0c0ca571cf6444ff4a9927a9ccd088
- SHA1 8cd83ab17e948c1bc3d7762a397b67270790b615
- SHA512 af43e305911cb7a50c64af3433c763d0a367778a6c8d767ed41a86530ac68ba5ede2adbb38aa60e0ec5627fbe4c5f3f81e683c5e5ae368681d4463b2bfc98c45
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\perfos32.exe" perfos32.exe - Executes dropped EXE 3 IoCs
pid Process 3160 perfos32.exe 652 perfos32.exe 1528 perfos32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\perfos32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe" 74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking\Linkage perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for SqlServer\Linkage perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data\Linkage perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking 4.0.0.0\Linkage perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for Oracle\Linkage perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage perfos32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 perfos32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage perfos32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1504 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 212 timeout.exe - Suspicious behavior: EnumeratesProcesses 101 IoCs
pid Process 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe 3160 perfos32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3160 perfos32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 672 wrote to memory of 3160 672 74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe 75 PID 672 wrote to memory of 3160 672 74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe 75 PID 672 wrote to memory of 3596 672 74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe 76 PID 672 wrote to memory of 3596 672 74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe 76 PID 672 wrote to memory of 2716 672 74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe 77 PID 672 wrote to memory of 2716 672 74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe 77 PID 2716 wrote to memory of 212 2716 cmd.exe 80 PID 2716 wrote to memory of 212 2716 cmd.exe 80 PID 3160 wrote to memory of 1504 3160 perfos32.exe 81 PID 3160 wrote to memory of 1504 3160 perfos32.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe"C:\Users\Admin\AppData\Local\Temp\74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\perfos32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\perfos32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\perfos32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:1504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:3596
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe" && del "C:\Users\Admin\AppData\Local\Temp\74730cf408bf94965b783eb01a1489939694100e01ecea7c332d3efcc30fd768.exe.config"2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:212
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3628
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\perfos32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\perfos32.exe arguments1⤵
- Executes dropped EXE
PID:652
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\perfos32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\perfos32.exe arguments1⤵
- Executes dropped EXE
PID:1528