Analysis
- max time kernel
147s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 11:02
General
- Target 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe
- Size 221KB
- Sample201111-dhlgh61fen
- SHA256 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 26 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 105 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe"C:\Users\Admin\AppData\Local\Temp\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umb32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umb32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umb32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe" && del "C:\Users\Admin\AppData\Local\Temp\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe.config"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umb32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umb32.exe arguments1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umb32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umb32.exe arguments1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umb32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umb32.exe arguments1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/232-172-0x00007FFA613F0000-0x00007FFA61D90000-memory.dmp
memory/2204-180-0x00007FFA613F0000-0x00007FFA61D90000-memory.dmp
memory/4336-131-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-134-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-96-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-97-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-99-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-100-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-98-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-101-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-102-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-103-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-104-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-106-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-107-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-108-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-105-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-109-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-110-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-138-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-111-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-113-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-114-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-115-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-116-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-117-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-118-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-119-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-120-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-121-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-122-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-123-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-124-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-125-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-126-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-127-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-129-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-128-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-130-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-94-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-132-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-133-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-137-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-135-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-95-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-136-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-112-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-139-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-140-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-141-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-142-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-143-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-144-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-145-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-146-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-147-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-149-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-150-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-151-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-152-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-148-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-153-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-154-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-156-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-155-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-158-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-157-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-159-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-160-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-161-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-162-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-163-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-164-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-165-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-167-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-166-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-168-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-93-0x0000000020AD0000-0x0000000020AEE000-memory.dmp
memory/4336-171-0x00000000218A0000-0x00000000218A1000-memory.dmp
memory/4336-92-0x00000000215A0000-0x00000000215A1000-memory.dmp
memory/4336-174-0x00000000218A0000-0x00000000218A1000-memory.dmp
memory/4336-14-0x00000000213A0000-0x00000000213A1000-memory.dmp
memory/4336-10-0x00000000213A0000-0x00000000213A1000-memory.dmp
memory/4336-6-0x00007FFA613F0000-0x00007FFA61D90000-memory.dmp
memory/4660-178-0x00007FFA613F0000-0x00007FFA61D90000-memory.dmp
memory/4796-0-0x00007FFA613F0000-0x00007FFA61D90000-memory.dmp