Analysis
- max time kernel
143s - max time network
138s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe
- Size 221KB
- Sample201110-s6nbstdrmj
- SHA256 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8
- MD5 e683d7df83dc88b0150209ee26d2640b
- SHA1 d8acea104bdcbf9166936f2baaf8c925919b6d68
- SHA512 29c2cb9c195632ae0c1fc92f0414720e2231fcb3a2731f2438b360d46323b53dc4535939dce4902e8d0997356dd56dced468965b54d24ad2dd242f159c047375
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\PerfStringBackup32.exe" PerfStringBackup32.exe - Executes dropped EXE 3 IoCs
pid Process 1316 PerfStringBackup32.exe 944 PerfStringBackup32.exe 1164 PerfStringBackup32.exe - Deletes itself 1 IoCs
pid Process 472 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*PerfStringBackup32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe" 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\PerfStringBackup32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe" 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage PerfStringBackup32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage PerfStringBackup32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage PerfStringBackup32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132494840073548512" PerfStringBackup32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage PerfStringBackup32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage PerfStringBackup32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage PerfStringBackup32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage PerfStringBackup32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage PerfStringBackup32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 PerfStringBackup32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage PerfStringBackup32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 PerfStringBackup32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage PerfStringBackup32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1036 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1556 timeout.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe 1316 PerfStringBackup32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1316 PerfStringBackup32.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1316 1876 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe 26 PID 1876 wrote to memory of 1316 1876 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe 26 PID 1876 wrote to memory of 1316 1876 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe 26 PID 1876 wrote to memory of 2004 1876 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe 27 PID 1876 wrote to memory of 2004 1876 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe 27 PID 1876 wrote to memory of 2004 1876 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe 27 PID 1876 wrote to memory of 472 1876 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe 29 PID 1876 wrote to memory of 472 1876 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe 29 PID 1876 wrote to memory of 472 1876 53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe 29 PID 472 wrote to memory of 1556 472 cmd.exe 31 PID 472 wrote to memory of 1556 472 cmd.exe 31 PID 472 wrote to memory of 1556 472 cmd.exe 31 PID 1316 wrote to memory of 1036 1316 PerfStringBackup32.exe 35 PID 1316 wrote to memory of 1036 1316 PerfStringBackup32.exe 35 PID 1316 wrote to memory of 1036 1316 PerfStringBackup32.exe 35 PID 1728 wrote to memory of 944 1728 taskeng.exe 40 PID 1728 wrote to memory of 944 1728 taskeng.exe 40 PID 1728 wrote to memory of 944 1728 taskeng.exe 40 PID 1728 wrote to memory of 1164 1728 taskeng.exe 41 PID 1728 wrote to memory of 1164 1728 taskeng.exe 41 PID 1728 wrote to memory of 1164 1728 taskeng.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe"C:\Users\Admin\AppData\Local\Temp\53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PerfStringBackup32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PerfStringBackup32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PerfStringBackup32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:1036
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2004
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe" && del "C:\Users\Admin\AppData\Local\Temp\53795ee37d419aeaf540b78881f30d53d47a5d5b83f83b45fba9b5bacdf8bdc8.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1556
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:968
-
C:\Windows\system32\taskeng.exetaskeng.exe {254680CE-A215-4496-B55A-A19DB27BB6C4} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PerfStringBackup32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PerfStringBackup32.exe arguments2⤵
- Executes dropped EXE
PID:944
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PerfStringBackup32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PerfStringBackup32.exe arguments2⤵
- Executes dropped EXE
PID:1164
-