Analysis
- max time kernel
42s - max time network
114s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 11:38
Static task
static1
Behavioral task
behavioral1
Sample
a009797259a9c5fa0c16e4050321754b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a009797259a9c5fa0c16e4050321754b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target a009797259a9c5fa0c16e4050321754b.exe
- Size 208KB
- Sample201117-9j9febkk3j
- SHA256 f8bb14872c59ab2fb7e0e15c511e72e140d59d5feaa3a3cca48997b29cd342c0
- MD5 a009797259a9c5fa0c16e4050321754b
- SHA1 a9cbc353e5527f31f7eb7bfef245a5c870779a7e
- SHA512 82dd5b24d78e359b46d62a631c7fd3e2f95573d5cac775b7aaba49fc2cd3a376cc7f7fd057201e9a7e9e6fe3e0a4ccc0092a10ff4c6cdfdd9a62259076da6e29
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
description pid Process procid_target PID 3444 created 4696 3444 WerFault.exe 67 PID 4176 created 504 4176 WerFault.exe 79 PID 4356 created 1736 4356 WerFault.exe 83 - ServiceHost packer 12 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/504-13-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/504-16-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/504-17-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/504-18-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/504-19-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/504-20-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/504-21-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/504-22-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/504-23-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1736-26-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1736-27-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1736-28-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 504 MPD.exe 1736 ALBJIIK.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\windows\system\ALBJIIK.exe MPD.exe File created C:\windows\system\ALBJIIK.exe.bat MPD.exe File created C:\windows\system\MPD.exe a009797259a9c5fa0c16e4050321754b.exe File opened for modification C:\windows\system\MPD.exe a009797259a9c5fa0c16e4050321754b.exe File created C:\windows\system\MPD.exe.bat a009797259a9c5fa0c16e4050321754b.exe File created C:\windows\system\ALBJIIK.exe MPD.exe - Program crash 3 IoCs
pid pid_target Process procid_target 3444 4696 WerFault.exe 67 4176 504 WerFault.exe 79 4356 1736 WerFault.exe 83 - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4696 a009797259a9c5fa0c16e4050321754b.exe 4696 a009797259a9c5fa0c16e4050321754b.exe 504 MPD.exe 504 MPD.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 4176 WerFault.exe 1736 ALBJIIK.exe 1736 ALBJIIK.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe 4356 WerFault.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 3444 WerFault.exe Token: SeBackupPrivilege 3444 WerFault.exe Token: SeDebugPrivilege 3444 WerFault.exe Token: SeDebugPrivilege 4176 WerFault.exe Token: SeDebugPrivilege 4356 WerFault.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4696 a009797259a9c5fa0c16e4050321754b.exe 4696 a009797259a9c5fa0c16e4050321754b.exe 504 MPD.exe 504 MPD.exe 1736 ALBJIIK.exe 1736 ALBJIIK.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4696 wrote to memory of 3468 4696 a009797259a9c5fa0c16e4050321754b.exe 75 PID 4696 wrote to memory of 3468 4696 a009797259a9c5fa0c16e4050321754b.exe 75 PID 4696 wrote to memory of 3468 4696 a009797259a9c5fa0c16e4050321754b.exe 75 PID 3468 wrote to memory of 504 3468 cmd.exe 79 PID 3468 wrote to memory of 504 3468 cmd.exe 79 PID 3468 wrote to memory of 504 3468 cmd.exe 79 PID 504 wrote to memory of 3220 504 MPD.exe 80 PID 504 wrote to memory of 3220 504 MPD.exe 80 PID 504 wrote to memory of 3220 504 MPD.exe 80 PID 3220 wrote to memory of 1736 3220 cmd.exe 83 PID 3220 wrote to memory of 1736 3220 cmd.exe 83 PID 3220 wrote to memory of 1736 3220 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\a009797259a9c5fa0c16e4050321754b.exe"C:\Users\Admin\AppData\Local\Temp\a009797259a9c5fa0c16e4050321754b.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPD.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\system\MPD.exeC:\windows\system\MPD.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ALBJIIK.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\system\ALBJIIK.exeC:\windows\system\ALBJIIK.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 7806⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 504 -s 9204⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 8882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444
-