Analysis
- max time kernel
143s - max time network
148s - platform
windows7_x64 - resource
win7v20201028 - submitted
12/11/2020, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe
- Size 222KB
- Sample201112-rlk2csd53e
- SHA256 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf
- MD5 c8d5d2ce58848b60c937bf7e43764179
- SHA1 cf01f8dfe69d48166f2ff080dce498ea8d55a9ac
- SHA512 f1f51496556fddb57adbe7373bcf7e307432972af2528e164c0e6aec2b55d60a9f6b4103a056b1897bfcc76c4bdfce49a380f5118a7da434b8a61ff393cc8070
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\bcdedit32.exe" bcdedit32.exe - Executes dropped EXE 4 IoCs
pid Process 1508 bcdedit32.exe 884 bcdedit32.exe 572 bcdedit32.exe 1724 bcdedit32.exe - Deletes itself 1 IoCs
pid Process 1660 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\bcdedit32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe" 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*bcdedit32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe" 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance bcdedit32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 bcdedit32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132496680537737216" bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage bcdedit32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage bcdedit32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage bcdedit32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 300 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1328 timeout.exe - Suspicious behavior: EnumeratesProcesses 68 IoCs
pid Process 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe 1508 bcdedit32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1508 bcdedit32.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 648 wrote to memory of 1508 648 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe 29 PID 648 wrote to memory of 1508 648 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe 29 PID 648 wrote to memory of 1508 648 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe 29 PID 648 wrote to memory of 1016 648 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe 30 PID 648 wrote to memory of 1016 648 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe 30 PID 648 wrote to memory of 1016 648 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe 30 PID 648 wrote to memory of 1660 648 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe 31 PID 648 wrote to memory of 1660 648 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe 31 PID 648 wrote to memory of 1660 648 464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe 31 PID 1660 wrote to memory of 1328 1660 cmd.exe 34 PID 1660 wrote to memory of 1328 1660 cmd.exe 34 PID 1660 wrote to memory of 1328 1660 cmd.exe 34 PID 1508 wrote to memory of 300 1508 bcdedit32.exe 35 PID 1508 wrote to memory of 300 1508 bcdedit32.exe 35 PID 1508 wrote to memory of 300 1508 bcdedit32.exe 35 PID 752 wrote to memory of 884 752 taskeng.exe 40 PID 752 wrote to memory of 884 752 taskeng.exe 40 PID 752 wrote to memory of 884 752 taskeng.exe 40 PID 752 wrote to memory of 572 752 taskeng.exe 41 PID 752 wrote to memory of 572 752 taskeng.exe 41 PID 752 wrote to memory of 572 752 taskeng.exe 41 PID 752 wrote to memory of 1724 752 taskeng.exe 42 PID 752 wrote to memory of 1724 752 taskeng.exe 42 PID 752 wrote to memory of 1724 752 taskeng.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe"C:\Users\Admin\AppData\Local\Temp\464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\bcdedit32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\bcdedit32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\bcdedit32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:300
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1016
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe" && del "C:\Users\Admin\AppData\Local\Temp\464e18204c62fb556867fa884488d776fc22f423f11bab4fdc45226aebe5f2cf.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1328
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1796
-
C:\Windows\system32\taskeng.exetaskeng.exe {A07AC3B4-B78B-4F98-B9D3-AC08ECB9FF4C} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\bcdedit32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\bcdedit32.exe arguments2⤵
- Executes dropped EXE
PID:884
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\bcdedit32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\bcdedit32.exe arguments2⤵
- Executes dropped EXE
PID:572
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\bcdedit32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\bcdedit32.exe arguments2⤵
- Executes dropped EXE
PID:1724
-