Analysis
- max time kernel
150s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe
- Size 6.3MB
- Sample201113-qpbrpll272
- SHA256 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef
- MD5 99b1ffe55eb0fa4c066a01fb2545dd3a
- SHA1 5e21f6e757c75d999a5c3eb3f94aac1e6370f313
- SHA512 c02f214784d266382c4e4f9c710db076e864d35922335a692725c7d020ee0a5fe9e96097ed14009d16ac1d448d433607a74bb40e969961d892178a9ef9b3e38e
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 5100 CDS.exe 4228 crypted.exe 4172 CDS.exe 3096 crypted.exe 4408 grihal.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chikoriy.exe grihal.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chikoriy.exe grihal.exe - Loads dropped DLL 2 IoCs
pid Process 5100 CDS.exe 4172 CDS.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\grihal.exe\" .." grihal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce crypted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" crypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\grihal.exe\" .." grihal.exe - JavaScript code in executable 4 IoCs
resource yara_rule behavioral2/files/0x000200000001ab35-1.dat js behavioral2/files/0x000200000001ab35-2.dat js behavioral2/files/0x000100000001ab47-13.dat js behavioral2/files/0x000100000001ab47-14.dat js - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5100 CDS.exe 5100 CDS.exe 4172 CDS.exe 4172 CDS.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3096 crypted.exe 4408 grihal.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe Token: 33 4408 grihal.exe Token: SeIncBasePriorityPrivilege 4408 grihal.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5100 CDS.exe 5100 CDS.exe 4172 CDS.exe 4172 CDS.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4704 wrote to memory of 5100 4704 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 73 PID 4704 wrote to memory of 5100 4704 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 73 PID 4704 wrote to memory of 5100 4704 be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe 73 PID 5100 wrote to memory of 4228 5100 CDS.exe 75 PID 5100 wrote to memory of 4228 5100 CDS.exe 75 PID 5100 wrote to memory of 4228 5100 CDS.exe 75 PID 4228 wrote to memory of 4172 4228 crypted.exe 77 PID 4228 wrote to memory of 4172 4228 crypted.exe 77 PID 4228 wrote to memory of 4172 4228 crypted.exe 77 PID 4172 wrote to memory of 3096 4172 CDS.exe 78 PID 4172 wrote to memory of 3096 4172 CDS.exe 78 PID 4172 wrote to memory of 3096 4172 CDS.exe 78 PID 3096 wrote to memory of 4408 3096 crypted.exe 81 PID 3096 wrote to memory of 4408 3096 crypted.exe 81 PID 3096 wrote to memory of 4408 3096 crypted.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe"C:\Users\Admin\AppData\Local\Temp\be3acd23cffe0baa73da9501728b70240077320fe57f729e46111e06ef67f2ef.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CDS.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\crypted.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\grihal.exe"C:\Users\Admin\AppData\Local\Temp\grihal.exe"6⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
-
-
-
-