Analysis
- max time kernel
54s - max time network
114s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
a01d2b1d45cb07545905c6525e20c6bc.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a01d2b1d45cb07545905c6525e20c6bc.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target a01d2b1d45cb07545905c6525e20c6bc.exe
- Size 208KB
- Sample201117-62887pdryn
- SHA256 9dc9e84417abae2d03346b9855469e751126477b52412bf9eff8f7aa09bb35ab
- MD5 a01d2b1d45cb07545905c6525e20c6bc
- SHA1 1d688ff4335bd7d76609767b130826bb7874a196
- SHA512 dd50eb7e2301d2df9ae6f8971fb657b38929600dbfa4b05c561456cf79f666f047aec3b9126d45488f1be1ab1961fa45a15fd8376d45e61c84d7f13ae402b88b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
description pid Process procid_target PID 1308 created 2604 1308 WerFault.exe 67 PID 2748 created 1276 2748 WerFault.exe 78 PID 3256 created 1344 3256 WerFault.exe 83 - ServiceHost packer 12 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/1276-16-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1276-17-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1276-19-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1344-18-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1344-20-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1344-15-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1276-21-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1276-24-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1276-25-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1276-26-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1276-27-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1276-28-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 1276 SNU.exe 1344 WZYME.exe - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File created C:\windows\SNU.exe a01d2b1d45cb07545905c6525e20c6bc.exe File opened for modification C:\windows\SNU.exe a01d2b1d45cb07545905c6525e20c6bc.exe File created C:\windows\SNU.exe.bat a01d2b1d45cb07545905c6525e20c6bc.exe File created C:\windows\system\WZYME.exe SNU.exe File opened for modification C:\windows\system\WZYME.exe SNU.exe File created C:\windows\system\WZYME.exe.bat SNU.exe - Program crash 3 IoCs
pid pid_target Process procid_target 1308 2604 WerFault.exe 67 2748 1276 WerFault.exe 78 3256 1344 WerFault.exe 83 - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2604 a01d2b1d45cb07545905c6525e20c6bc.exe 2604 a01d2b1d45cb07545905c6525e20c6bc.exe 1276 SNU.exe 1276 SNU.exe 1344 WZYME.exe 1344 WZYME.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 1308 WerFault.exe 2748 WerFault.exe 3256 WerFault.exe 2748 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe 3256 WerFault.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeRestorePrivilege 1308 WerFault.exe Token: SeBackupPrivilege 1308 WerFault.exe Token: SeRestorePrivilege 2748 WerFault.exe Token: SeBackupPrivilege 2748 WerFault.exe Token: SeBackupPrivilege 2748 WerFault.exe Token: SeDebugPrivilege 1308 WerFault.exe Token: SeDebugPrivilege 2748 WerFault.exe Token: SeDebugPrivilege 3256 WerFault.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2604 a01d2b1d45cb07545905c6525e20c6bc.exe 2604 a01d2b1d45cb07545905c6525e20c6bc.exe 1276 SNU.exe 1276 SNU.exe 1344 WZYME.exe 1344 WZYME.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2604 wrote to memory of 3952 2604 a01d2b1d45cb07545905c6525e20c6bc.exe 75 PID 2604 wrote to memory of 3952 2604 a01d2b1d45cb07545905c6525e20c6bc.exe 75 PID 2604 wrote to memory of 3952 2604 a01d2b1d45cb07545905c6525e20c6bc.exe 75 PID 3952 wrote to memory of 1276 3952 cmd.exe 78 PID 3952 wrote to memory of 1276 3952 cmd.exe 78 PID 3952 wrote to memory of 1276 3952 cmd.exe 78 PID 1276 wrote to memory of 1336 1276 SNU.exe 80 PID 1276 wrote to memory of 1336 1276 SNU.exe 80 PID 1276 wrote to memory of 1336 1276 SNU.exe 80 PID 1336 wrote to memory of 1344 1336 cmd.exe 83 PID 1336 wrote to memory of 1344 1336 cmd.exe 83 PID 1336 wrote to memory of 1344 1336 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\a01d2b1d45cb07545905c6525e20c6bc.exe"C:\Users\Admin\AppData\Local\Temp\a01d2b1d45cb07545905c6525e20c6bc.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNU.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\SNU.exeC:\windows\SNU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZYME.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\windows\system\WZYME.exeC:\windows\system\WZYME.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 7806⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 11844⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 11402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308
-