Analysis
- max time kernel
146s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50.exe
- Size 447KB
- Sample201112-4g27f7qvss
- SHA256 0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50
- MD5 91b9a23f8fb2ae2f0424ee0e1ba96c06
- SHA1 313425e540b020cec7efdaa16a869a86a0f1c525
- SHA512 a8285e99a31be503bdc766de184174b81a79729eaef7d3e16866f308057ddaf2f353b659bd4bac1b65ffdef709e185e30d8c495b2717f34abd1c3216c8a80b73
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 200 Charmy.sfx.exe 2264 Charmy.exe 3932 server.exe - Modifies Windows Firewall 1 TTPs
- Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe Token: 33 3932 server.exe Token: SeIncBasePriorityPrivilege 3932 server.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3304 wrote to memory of 2192 3304 0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50.exe 75 PID 3304 wrote to memory of 2192 3304 0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50.exe 75 PID 3304 wrote to memory of 2192 3304 0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50.exe 75 PID 2192 wrote to memory of 200 2192 cmd.exe 78 PID 2192 wrote to memory of 200 2192 cmd.exe 78 PID 2192 wrote to memory of 200 2192 cmd.exe 78 PID 200 wrote to memory of 2264 200 Charmy.sfx.exe 79 PID 200 wrote to memory of 2264 200 Charmy.sfx.exe 79 PID 200 wrote to memory of 2264 200 Charmy.sfx.exe 79 PID 2264 wrote to memory of 3932 2264 Charmy.exe 82 PID 2264 wrote to memory of 3932 2264 Charmy.exe 82 PID 2264 wrote to memory of 3932 2264 Charmy.exe 82 PID 3932 wrote to memory of 2652 3932 server.exe 84 PID 3932 wrote to memory of 2652 3932 server.exe 84 PID 3932 wrote to memory of 2652 3932 server.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50.exe"C:\Users\Admin\AppData\Local\Temp\0edb9b65eac66a632e3e44c385ee861d360ee50e84e314c855bcf01aa9933c50.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\start.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Charmy.sfx.exeCharmy.sfx -p4f3gfs4h5dsf4hsa2 -dc:\3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Charmy.exe"C:\Charmy.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE6⤵PID:2652
-
-
-
-
-