Analysis
- max time kernel
150s - max time network
148s - platform
windows7_x64 - resource
win7v20201028 - submitted
13/11/2020, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe
- Size 6.3MB
- Sample201113-qpbrpll272
- SHA256 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef
- MD5 99b1ffe55eb0fa4c066a01fb2545dd3a
- SHA1 5e21f6e757c75d999a5c3eb3f94aac1e6370f313
- SHA512 c02f214784d266382c4e4f9c710db076e864d35922335a692725c7d020ee0a5fe9e96097ed14009d16ac1d448d433607a74bb40e969961d892178a9ef9b3e38e
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 1948 CDS.exe 316 crypted.exe 1440 CDS.exe 672 crypted.exe 1572 grihal.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chikoriy.exe grihal.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chikoriy.exe grihal.exe - Loads dropped DLL 19 IoCs
pid Process 1668 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 1948 CDS.exe 1948 CDS.exe 1948 CDS.exe 1948 CDS.exe 1948 CDS.exe 1948 CDS.exe 1948 CDS.exe 316 crypted.exe 316 crypted.exe 1440 CDS.exe 1440 CDS.exe 1440 CDS.exe 1440 CDS.exe 1440 CDS.exe 1440 CDS.exe 672 crypted.exe 672 crypted.exe 1572 grihal.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce crypted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" crypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\grihal.exe\" .." grihal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\grihal.exe\" .." grihal.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe - JavaScript code in executable 10 IoCs
resource yara_rule behavioral1/files/0x00050000000130ca-2.dat js behavioral1/files/0x00050000000130ca-0.dat js behavioral1/files/0x00050000000130ca-6.dat js behavioral1/files/0x00050000000130ca-5.dat js behavioral1/files/0x00050000000130ca-11.dat js behavioral1/files/0x00030000000130d8-20.dat js behavioral1/files/0x00030000000130d8-22.dat js behavioral1/files/0x00030000000130d8-25.dat js behavioral1/files/0x00030000000130d8-26.dat js behavioral1/files/0x00030000000130d8-31.dat js - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1948 CDS.exe 1948 CDS.exe 1440 CDS.exe 1440 CDS.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1572 grihal.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe Token: 33 1572 grihal.exe Token: SeIncBasePriorityPrivilege 1572 grihal.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1948 CDS.exe 1948 CDS.exe 1440 CDS.exe 1440 CDS.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1948 1668 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 26 PID 1668 wrote to memory of 1948 1668 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 26 PID 1668 wrote to memory of 1948 1668 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 26 PID 1668 wrote to memory of 1948 1668 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 26 PID 1668 wrote to memory of 1948 1668 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 26 PID 1668 wrote to memory of 1948 1668 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 26 PID 1668 wrote to memory of 1948 1668 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 26 PID 1948 wrote to memory of 316 1948 CDS.exe 30 PID 1948 wrote to memory of 316 1948 CDS.exe 30 PID 1948 wrote to memory of 316 1948 CDS.exe 30 PID 1948 wrote to memory of 316 1948 CDS.exe 30 PID 1948 wrote to memory of 316 1948 CDS.exe 30 PID 1948 wrote to memory of 316 1948 CDS.exe 30 PID 1948 wrote to memory of 316 1948 CDS.exe 30 PID 316 wrote to memory of 1440 316 crypted.exe 31 PID 316 wrote to memory of 1440 316 crypted.exe 31 PID 316 wrote to memory of 1440 316 crypted.exe 31 PID 316 wrote to memory of 1440 316 crypted.exe 31 PID 316 wrote to memory of 1440 316 crypted.exe 31 PID 316 wrote to memory of 1440 316 crypted.exe 31 PID 316 wrote to memory of 1440 316 crypted.exe 31 PID 1440 wrote to memory of 672 1440 CDS.exe 32 PID 1440 wrote to memory of 672 1440 CDS.exe 32 PID 1440 wrote to memory of 672 1440 CDS.exe 32 PID 1440 wrote to memory of 672 1440 CDS.exe 32 PID 1440 wrote to memory of 672 1440 CDS.exe 32 PID 1440 wrote to memory of 672 1440 CDS.exe 32 PID 1440 wrote to memory of 672 1440 CDS.exe 32 PID 672 wrote to memory of 1572 672 crypted.exe 33 PID 672 wrote to memory of 1572 672 crypted.exe 33 PID 672 wrote to memory of 1572 672 crypted.exe 33 PID 672 wrote to memory of 1572 672 crypted.exe 33 PID 672 wrote to memory of 1572 672 crypted.exe 33 PID 672 wrote to memory of 1572 672 crypted.exe 33 PID 672 wrote to memory of 1572 672 crypted.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe"C:\Users\Admin\AppData\Local\Temp\be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CDS.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\crypted.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\grihal.exe"C:\Users\Admin\AppData\Local\Temp\grihal.exe"6⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
-
-
-