b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0

Analysis

max time kernel
139s
max time network
102s
platform
windows10_x64
resource
win10v20201028
submitted
12/11/2020, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe
Size 680KB
Sample201112-ms98alwcgn
SHA256 b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0
MD5 f8c5fced0bff96f22a841442597daaaa
SHA1 228e484ea5774087181d4e1ba8eceac7762bebfb
SHA512 8ce7e9a4522ade5b666f62e31ad3066b5e9175216e438ff875fcd6b8ccff80e87cc8af2cddd0d3112198f37daba591d2d50a6ae9049876bb10afa217a1badb39
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4760 set thread context of 884	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	80

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
884	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe
884	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 672	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	78
PID 4760 wrote to memory of 672	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	78
PID 4760 wrote to memory of 672	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	78
PID 4760 wrote to memory of 884	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	80
PID 4760 wrote to memory of 884	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	80
PID 4760 wrote to memory of 884	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	80
PID 4760 wrote to memory of 884	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	80
PID 4760 wrote to memory of 884	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	80
PID 4760 wrote to memory of 884	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	80
PID 4760 wrote to memory of 884	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	80
PID 4760 wrote to memory of 884	4760	b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe	80

C:\Users\Admin\AppData\Local\Temp\b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe
"C:\Users\Admin\AppData\Local\Temp\b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iwVdWGxzOjr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE2DF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:672
- C:\Users\Admin\AppData\Local\Temp\b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe
  "C:\Users\Admin\AppData\Local\Temp\b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-22-0x0000000005D80000-0x0000000005D81000-memory.dmp

Download

memory/884-21-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/884-16-0x0000000073150000-0x000000007383E000-memory.dmp

Download

memory/884-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4760-5-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/4760-10-0x0000000006500000-0x0000000006538000-memory.dmp

Download

memory/4760-9-0x0000000006490000-0x00000000064FD000-memory.dmp

Download

memory/4760-8-0x0000000005630000-0x000000000563B000-memory.dmp

Download

memory/4760-7-0x00000000058E0000-0x00000000058E1000-memory.dmp

Download

memory/4760-6-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/4760-0-0x0000000073150000-0x000000007383E000-memory.dmp

Download

memory/4760-4-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Download

memory/4760-3-0x0000000005640000-0x0000000005641000-memory.dmp

Download

memory/4760-1-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download