Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 14:58
General
- Target Build1.exe
- Size 4.1MB
- Sample201112-jhsvf7g4pe
- SHA256 7cebce024d5351e0179898fffce2628756bdcd33f9ce3833f922f1265b6e5f73
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Executes dropped EXE 3 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 12 IoCs
- JavaScript code in executable 4 IoCs
- Drops file in Program Files directory 3 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Build1.exe"C:\Users\Admin\AppData\Local\Temp\Build1.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Cosmopolitanize\emperor.exe"C:\Program Files (x86)\Cosmopolitanize\emperor.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Cosmopolitanize\emperor.exe"C:\Program Files (x86)\Cosmopolitanize\emperor.exe" -second3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SchTasks /create /f /XML %temp%\LogFile.xml /TN \microsoft\windows\defrag\scheduleddefrag && schtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE && schtasks /run /TN \microsoft\windows\defrag\scheduleddefrag2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSchTasks /create /f /XML C:\Users\Admin\AppData\Local\Temp\LogFile.xml /TN \microsoft\windows\defrag\scheduleddefrag3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /TN \microsoft\windows\defrag\scheduleddefrag3⤵
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Cosmopolitanize\emperor.exe"C:\Program Files (x86)\Cosmopolitanize\emperor.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2112-449-0x00000000036D0000-0x00000000036D1000-memory.dmp
memory/2112-416-0x00000000036D0000-0x00000000036D1000-memory.dmp
memory/2112-462-0x00000000041D0000-0x00000000041D1000-memory.dmp
memory/2112-464-0x00000000041D0000-0x00000000041D1000-memory.dmp
memory/2112-463-0x00000000049D0000-0x00000000049D1000-memory.dmp
memory/2112-418-0x00000000036D0000-0x00000000036D1000-memory.dmp
memory/2112-457-0x00000000036D0000-0x00000000036D1000-memory.dmp
memory/2112-417-0x0000000003ED0000-0x0000000003ED1000-memory.dmp
memory/3156-786-0x0000000003A30000-0x0000000003A31000-memory.dmp
memory/3156-787-0x0000000004230000-0x0000000004231000-memory.dmp
memory/3156-788-0x0000000003A30000-0x0000000003A31000-memory.dmp
memory/3156-794-0x0000000003A30000-0x0000000003A31000-memory.dmp
memory/3156-1101-0x0000000003A30000-0x0000000003A31000-memory.dmp
memory/3156-1148-0x0000000003A30000-0x0000000003A31000-memory.dmp
memory/3708-13-0x0000000003870000-0x0000000003871000-memory.dmp
memory/3708-11-0x0000000003870000-0x0000000003871000-memory.dmp
memory/3708-12-0x0000000004070000-0x0000000004071000-memory.dmp