95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e

Analysis

max time kernel
104s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
12/11/2020, 13:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
Size 1.6MB
Sample201112-3hv2rmtvq6
SHA256 95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e
MD5 d3bca84de9af4e2270cc07289ccba890
SHA1 67d4f0f4f6a1af950762b7496ae240ec57d21310
SHA512 ed9f152176c0d147eb442b1164fc15f030eb0c59beebe0887b964f8cd92b38f110b7e828e611fd2af8f21742c6bf785dff1d71fde698e742b35dd200c0e91c21
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 3672	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	82

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
3672	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
3672	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
Token: SeDebugPrivilege	3672	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 592	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	78
PID 580 wrote to memory of 592	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	78
PID 580 wrote to memory of 592	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	78
PID 580 wrote to memory of 2452	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	80
PID 580 wrote to memory of 2452	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	80
PID 580 wrote to memory of 2452	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	80
PID 580 wrote to memory of 4076	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	81
PID 580 wrote to memory of 4076	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	81
PID 580 wrote to memory of 4076	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	81
PID 580 wrote to memory of 3672	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	82
PID 580 wrote to memory of 3672	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	82
PID 580 wrote to memory of 3672	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	82
PID 580 wrote to memory of 3672	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	82
PID 580 wrote to memory of 3672	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	82
PID 580 wrote to memory of 3672	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	82
PID 580 wrote to memory of 3672	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	82
PID 580 wrote to memory of 3672	580	95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe	82

C:\Users\Admin\AppData\Local\Temp\95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
"C:\Users\Admin\AppData\Local\Temp\95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WYPSWEfP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6BEA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:592
- C:\Users\Admin\AppData\Local\Temp\95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
  "C:\Users\Admin\AppData\Local\Temp\95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe"
  2⤵
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
  "C:\Users\Admin\AppData\Local\Temp\95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe"
  2⤵
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe
  "C:\Users\Admin\AppData\Local\Temp\95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-9-0x00000000088B0000-0x000000000891E000-memory.dmp

Download

memory/580-10-0x0000000008920000-0x0000000008959000-memory.dmp

Download

memory/580-5-0x0000000007D10000-0x0000000007D11000-memory.dmp

Download

memory/580-6-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/580-7-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Download

memory/580-8-0x0000000001510000-0x000000000151B000-memory.dmp

Download

memory/580-0-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/580-4-0x0000000008170000-0x0000000008171000-memory.dmp

Download

memory/580-1-0x0000000000D20000-0x0000000000D21000-memory.dmp

Download

memory/580-3-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

Download

memory/3672-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3672-16-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/3672-21-0x0000000005750000-0x0000000005751000-memory.dmp

Download

memory/3672-22-0x0000000006390000-0x0000000006391000-memory.dmp

Download