Analysis
- max time kernel
146s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe
- Size 220KB
- Sample201110-dd6ad2xrma
- SHA256 e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db
- MD5 b1da296fa0822b2578ed8a4583a4c56c
- SHA1 58eef021310126bd089063b0140d7371b7e4da09
- SHA512 c1774964be4ad72865e5db247816afba0994234d6cee28b5913e371ee4714b5a0b1d95b96f41f018c062e699a57eff6fed671f3b00c81c9936646c00d907444d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\l_intl32.exe" l_intl32.exe - Executes dropped EXE 3 IoCs
pid Process 3356 l_intl32.exe 1556 l_intl32.exe 1376 l_intl32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\l_intl32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe" e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data\Linkage l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking\Linkage l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking 4.0.0.0\Linkage l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for Oracle\Linkage l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for SqlServer\Linkage l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 l_intl32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 l_intl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage l_intl32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3940 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2760 timeout.exe - Suspicious behavior: EnumeratesProcesses 101 IoCs
pid Process 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe 3356 l_intl32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3356 l_intl32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3980 wrote to memory of 3356 3980 e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe 76 PID 3980 wrote to memory of 3356 3980 e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe 76 PID 3980 wrote to memory of 4004 3980 e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe 77 PID 3980 wrote to memory of 4004 3980 e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe 77 PID 3980 wrote to memory of 2592 3980 e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe 78 PID 3980 wrote to memory of 2592 3980 e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe 78 PID 2592 wrote to memory of 2760 2592 cmd.exe 81 PID 2592 wrote to memory of 2760 2592 cmd.exe 81 PID 3356 wrote to memory of 3940 3356 l_intl32.exe 82 PID 3356 wrote to memory of 3940 3356 l_intl32.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe"C:\Users\Admin\AppData\Local\Temp\e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\l_intl32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\l_intl32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\l_intl32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:3940
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:4004
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe" && del "C:\Users\Admin\AppData\Local\Temp\e73d6c91f6f097477ffa6afdb0fc5b182ccda5889d16b277c16e4c8aec5268db.exe.config"2⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:2760
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2112
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\l_intl32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\l_intl32.exe arguments1⤵
- Executes dropped EXE
PID:1556
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\l_intl32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\l_intl32.exe arguments1⤵
- Executes dropped EXE
PID:1376