Analysis
- max time kernel
142s - max time network
141s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0.exe
- Size 447KB
- Sample201111-23n65wy8ca
- SHA256 452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0
- MD5 1dc6e046bf3f54ea59b9bb7ee367c6e7
- SHA1 d66486a71b3ce05b09999d3880550fdc3912df6f
- SHA512 ac7453eb826cb6f6b1b3cb5bf96ce85777fe1bf75525ac959c333bcd4c48e73230d38b143d6304e29290862ee3a3c159e99485adfa9bee406635d0b3f4c27053
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2464 Charmy.sfx.exe 2240 Charmy.exe 2492 server.exe - Modifies Windows Firewall 1 TTPs
- Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe Token: 33 2492 server.exe Token: SeIncBasePriorityPrivilege 2492 server.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1028 wrote to memory of 196 1028 452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0.exe 76 PID 1028 wrote to memory of 196 1028 452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0.exe 76 PID 1028 wrote to memory of 196 1028 452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0.exe 76 PID 196 wrote to memory of 2464 196 cmd.exe 79 PID 196 wrote to memory of 2464 196 cmd.exe 79 PID 196 wrote to memory of 2464 196 cmd.exe 79 PID 2464 wrote to memory of 2240 2464 Charmy.sfx.exe 80 PID 2464 wrote to memory of 2240 2464 Charmy.sfx.exe 80 PID 2464 wrote to memory of 2240 2464 Charmy.sfx.exe 80 PID 2240 wrote to memory of 2492 2240 Charmy.exe 84 PID 2240 wrote to memory of 2492 2240 Charmy.exe 84 PID 2240 wrote to memory of 2492 2240 Charmy.exe 84 PID 2492 wrote to memory of 2556 2492 server.exe 85 PID 2492 wrote to memory of 2556 2492 server.exe 85 PID 2492 wrote to memory of 2556 2492 server.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0.exe"C:\Users\Admin\AppData\Local\Temp\452d3d97689e5c5fcfdb2cad360b5768fbb7fedd07166e4e5131844196d4ddb0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\start.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Charmy.sfx.exeCharmy.sfx -p4f3gfs4h5dsf4hsa2 -dc:\3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Charmy.exe"C:\Charmy.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE6⤵PID:2556
-
-
-
-
-