Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-11-2020 12:23
General
-
Target
7d180125f28a3625c407fee1767c0df3.exe
-
Size
9.7MB
-
MD5
b48e8f6cd5f6b0785d39274d0633801d
-
SHA1
7fea985ab3d94abc817360c280a09c59a6b59f58
-
SHA256
4aa2f937edd661a5a3762c25d129d27085562e816e03a7063a5f43446608a730
-
SHA512
32cdb545541acd24a5b878c4c81e70cd2d63542697fce0dc363cadb317a1714bf028b4ad78dc7c1c57db08940e215150f96f6687098970f1ac54c0c7884529ec
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
ServiceHost packer 31 IoCs
Detects ServiceHost packer used for .NET malware
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 184 IoCs
-
Program crash 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d180125f28a3625c407fee1767c0df3.exe"C:\Users\Admin\AppData\Local\Temp\7d180125f28a3625c407fee1767c0df3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NVS8E.tmp\7d180125f28a3625c407fee1767c0df3.tmp"C:\Users\Admin\AppData\Local\Temp\is-NVS8E.tmp\7d180125f28a3625c407fee1767c0df3.tmp" /SL5="$20118,9852964,58368,C:\Users\Admin\AppData\Local\Temp\7d180125f28a3625c407fee1767c0df3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\UdioConverter 32bit\UdioConverter.exe"C:\Program Files (x86)\UdioConverter 32bit\UdioConverter.exe" 7d180125f28a3625c407fee1767c0df3.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 8204⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 8244⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 7924⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 8364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 8724⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\UdioConverter 32bit\UdioConverter.exeMD5
ada6ffe2d5feac62c6d71379cbca677f
SHA16ab66f0c0f239a2f0534ebda6ae097bf2ce6c02d
SHA2564edb495fb84dc4ba5b2cd7896d83908c2ea0df4da8b1f601ae2ce17bc54c5096
SHA512502dff71ca0ba0f3af47acf12a2b43aa43ce6008cfc0554d912015fc3a296a09cf95dd6890f6641ca3036e7c8b77e4521bf284903fb760dafb3223d23c2a806d
-
C:\Program Files (x86)\UdioConverter 32bit\UdioConverter.exeMD5
ada6ffe2d5feac62c6d71379cbca677f
SHA16ab66f0c0f239a2f0534ebda6ae097bf2ce6c02d
SHA2564edb495fb84dc4ba5b2cd7896d83908c2ea0df4da8b1f601ae2ce17bc54c5096
SHA512502dff71ca0ba0f3af47acf12a2b43aa43ce6008cfc0554d912015fc3a296a09cf95dd6890f6641ca3036e7c8b77e4521bf284903fb760dafb3223d23c2a806d
-
C:\Users\Admin\AppData\Local\Temp\is-NVS8E.tmp\7d180125f28a3625c407fee1767c0df3.tmpMD5
cf03b2ebd31db778f46ca4e77fe6f68b
SHA101804b307afd53b4f98b731595c66a2779eb5262
SHA25698df318c044a7501d784c5771b285cdf35cefaf1b01968d5f39aee4734b0dcab
SHA51205e2fbea6d73ff9fb284723bcde31c52bc3955c40c675e606cb2fe9ca52a49d88920e0a9bdd9f00361fc06a7562e7c3623235d4364e528f1d37297cb3e524744
-
C:\Users\Admin\AppData\Local\Temp\is-NVS8E.tmp\7d180125f28a3625c407fee1767c0df3.tmpMD5
cf03b2ebd31db778f46ca4e77fe6f68b
SHA101804b307afd53b4f98b731595c66a2779eb5262
SHA25698df318c044a7501d784c5771b285cdf35cefaf1b01968d5f39aee4734b0dcab
SHA51205e2fbea6d73ff9fb284723bcde31c52bc3955c40c675e606cb2fe9ca52a49d88920e0a9bdd9f00361fc06a7562e7c3623235d4364e528f1d37297cb3e524744
-
\Users\Admin\AppData\Local\Temp\is-93LKR.tmp\_isetup\_iscrypt.dllMD5
a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
memory/200-17-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/200-8-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/200-10-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/2924-30-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/2924-22-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/3188-28-0x0000000000000000-mapping.dmp
-
memory/3188-33-0x0000000000000000-mapping.dmp
-
memory/3188-12-0x0000000000000000-mapping.dmp
-
memory/3188-16-0x0000000000000000-mapping.dmp
-
memory/3188-14-0x0000000000000000-mapping.dmp
-
memory/3188-13-0x0000000000000000-mapping.dmp
-
memory/3188-18-0x0000000000000000-mapping.dmp
-
memory/3188-19-0x0000000000000000-mapping.dmp
-
memory/3188-20-0x0000000000000000-mapping.dmp
-
memory/3188-21-0x0000000000000000-mapping.dmp
-
memory/3188-6-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/3188-25-0x0000000000000000-mapping.dmp
-
memory/3188-26-0x0000000000000000-mapping.dmp
-
memory/3188-27-0x0000000000000000-mapping.dmp
-
memory/3188-7-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/3188-29-0x0000000000000000-mapping.dmp
-
memory/3188-4-0x0000000000000000-mapping.dmp
-
memory/3188-31-0x0000000000000000-mapping.dmp
-
memory/3188-32-0x0000000000000000-mapping.dmp
-
memory/3188-15-0x0000000000000000-mapping.dmp
-
memory/3188-34-0x0000000000000000-mapping.dmp
-
memory/3188-58-0x0000000000000000-mapping.dmp
-
memory/3188-62-0x0000000000000000-mapping.dmp
-
memory/3188-39-0x0000000000000000-mapping.dmp
-
memory/3188-40-0x0000000000000000-mapping.dmp
-
memory/3188-41-0x0000000000000000-mapping.dmp
-
memory/3188-42-0x0000000000000000-mapping.dmp
-
memory/3188-61-0x0000000000000000-mapping.dmp
-
memory/3188-60-0x0000000000000000-mapping.dmp
-
memory/3188-59-0x0000000000000000-mapping.dmp
-
memory/3188-54-0x0000000000000000-mapping.dmp
-
memory/3188-53-0x0000000000000000-mapping.dmp
-
memory/3188-51-0x0000000000000000-mapping.dmp
-
memory/3188-52-0x0000000000000000-mapping.dmp
-
memory/3928-55-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/3980-43-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/3980-38-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/3980-35-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/4016-0-0x0000000000000000-mapping.dmp
-
memory/4036-48-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB