Analysis

  • max time kernel
    135s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17-11-2020 12:16

General

  • Target

    5ef685fccf2f7fffae019b3a239e4809.exe

  • Size

    11.1MB

  • MD5

    c4a7acac6f4bf956245068a0461ead2e

  • SHA1

    f6366536be958e8a3f6392d7aaa6c01daff1c8c6

  • SHA256

    f82e9be772f1aaf55cc78cc782d9ba6a9c6fb57280666d09bbcc542755145560

  • SHA512

    f847942198994c3bd6b95bacc2f45598ab290946da98afb7d20e69af1a5c1cded5227d32f90626f5c7009bddfa37ec3d516fd70d66e549c3606f36880163ce8a

Score
9/10

Malware Config

Signatures

  • ServiceHost packer 74 IoCs

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 11 IoCs
  • Program crash 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 150 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ef685fccf2f7fffae019b3a239e4809.exe
    "C:\Users\Admin\AppData\Local\Temp\5ef685fccf2f7fffae019b3a239e4809.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Users\Admin\AppData\Local\Temp\is-94P46.tmp\5ef685fccf2f7fffae019b3a239e4809.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-94P46.tmp\5ef685fccf2f7fffae019b3a239e4809.tmp" /SL5="$2012C,10888778,790016,C:\Users\Admin\AppData\Local\Temp\5ef685fccf2f7fffae019b3a239e4809.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Program Files (x86)\S-Mobile Uploader\BurnerService\wmfdist.exe
        "C:\Program Files (x86)\S-Mobile Uploader\BurnerService\wmfdist.exe" /Q:A /R:N
        3⤵
        • Executes dropped EXE
        PID:3744
      • C:\Program Files (x86)\S-Mobile Uploader\BurnerService\SVideoBurner.exe
        "C:\Program Files (x86)\S-Mobile Uploader\BurnerService\SVideoBurner.exe" 5ef685fccf2f7fffae019b3a239e4809.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:440
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 836
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3352
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 816
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3168
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 836
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:840
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 876
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1596
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 880
          4⤵
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:2288
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 800
          4⤵
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:2744
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 852
          4⤵
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:4660
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 880
          4⤵
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:196
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 852
          4⤵
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:444
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 808
          4⤵
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:3116

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\S-Mobile Uploader\BurnerService\SVideoBurner.exe
    MD5

    b081512f1d90d3e858eabcc1a36c101f

    SHA1

    697402dc34bcb7fa851e2bc5dcf48fb26c31fd3c

    SHA256

    f2cdc65d28d40c0402a3aab9133c3ea5f13d7ddadde65577ae4e1b90081f47f7

    SHA512

    91c74c32d8957ebf2a57a7bd7aa4179ea3fbcd43058c7b84a751e435779cb7c8fc2cfdbe0e834945214280824b44c0049d7a2b2d627c90ed0899ca81e7956acf

  • C:\Program Files (x86)\S-Mobile Uploader\BurnerService\SVideoBurner.exe
    MD5

    b081512f1d90d3e858eabcc1a36c101f

    SHA1

    697402dc34bcb7fa851e2bc5dcf48fb26c31fd3c

    SHA256

    f2cdc65d28d40c0402a3aab9133c3ea5f13d7ddadde65577ae4e1b90081f47f7

    SHA512

    91c74c32d8957ebf2a57a7bd7aa4179ea3fbcd43058c7b84a751e435779cb7c8fc2cfdbe0e834945214280824b44c0049d7a2b2d627c90ed0899ca81e7956acf

  • C:\Program Files (x86)\S-Mobile Uploader\BurnerService\sqlite3.dll
    MD5

    e477a96c8f2b18d6b5c27bde49c990bf

    SHA1

    e980c9bf41330d1e5bd04556db4646a0210f7409

    SHA256

    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

    SHA512

    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

  • C:\Program Files (x86)\S-Mobile Uploader\BurnerService\wmfdist.exe
    MD5

    f59090e9a8070d7fbbdcc8895d2169a3

    SHA1

    370e62290cac6a6c7aa13442741caf6671437a54

    SHA256

    a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

    SHA512

    45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

  • C:\Program Files (x86)\S-Mobile Uploader\BurnerService\wmfdist.exe
    MD5

    f59090e9a8070d7fbbdcc8895d2169a3

    SHA1

    370e62290cac6a6c7aa13442741caf6671437a54

    SHA256

    a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

    SHA512

    45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

  • C:\Users\Admin\AppData\Local\Temp\is-94P46.tmp\5ef685fccf2f7fffae019b3a239e4809.tmp
    MD5

    bd5ba940935c395768d98cc2911a321c

    SHA1

    0ba748ce837d78527d920a5dac66c7600f97af71

    SHA256

    9acfdb224158ea8f006c5e7a249ee97e27da848ad45e11d425947183fa86131b

    SHA512

    17c96dda1f64beda671357831ff6d4f5354b66fb484943c0929ecec9f752de404a973f1e598dbc2739567f808283bd8189552ff597fc45d7df71c28e18e10c9b

  • C:\Users\Admin\AppData\Local\Temp\is-94P46.tmp\5ef685fccf2f7fffae019b3a239e4809.tmp
    MD5

    bd5ba940935c395768d98cc2911a321c

    SHA1

    0ba748ce837d78527d920a5dac66c7600f97af71

    SHA256

    9acfdb224158ea8f006c5e7a249ee97e27da848ad45e11d425947183fa86131b

    SHA512

    17c96dda1f64beda671357831ff6d4f5354b66fb484943c0929ecec9f752de404a973f1e598dbc2739567f808283bd8189552ff597fc45d7df71c28e18e10c9b

  • \Program Files (x86)\S-Mobile Uploader\BurnerService\sqlite3.dll
    MD5

    e477a96c8f2b18d6b5c27bde49c990bf

    SHA1

    e980c9bf41330d1e5bd04556db4646a0210f7409

    SHA256

    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

    SHA512

    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

  • \Users\Admin\AppData\Local\Temp\is-RUDE3.tmp\_isetup\_iscrypt.dll
    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • \Users\Admin\AppData\Local\Temp\is-RUDE3.tmp\_isetup\_isdecmp.dll
    MD5

    77d6d961f71a8c558513bed6fd0ad6f1

    SHA1

    122bb9ed6704b72250e4e31b5d5fc2f0476c4b6a

    SHA256

    5da7c8d33d3b7db46277012d92875c0b850c8abf1eb3c8c9c5b9532089a0bcf0

    SHA512

    b0921e2442b4cdec8cc479ba3751a01c0646a4804e2f4a5d5632fa2dbf54cc45d4cccffa4d5b522d42afc2f6a622e07882ed7e663c8462333b082e82503f335a

  • \Users\Admin\AppData\Local\Temp\is-RUDE3.tmp\_isetup\_isdecmp.dll
    MD5

    77d6d961f71a8c558513bed6fd0ad6f1

    SHA1

    122bb9ed6704b72250e4e31b5d5fc2f0476c4b6a

    SHA256

    5da7c8d33d3b7db46277012d92875c0b850c8abf1eb3c8c9c5b9532089a0bcf0

    SHA512

    b0921e2442b4cdec8cc479ba3751a01c0646a4804e2f4a5d5632fa2dbf54cc45d4cccffa4d5b522d42afc2f6a622e07882ed7e663c8462333b082e82503f335a

  • memory/196-161-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
    Filesize

    4KB

  • memory/440-26-0x0000000000000000-mapping.dmp
  • memory/440-131-0x0000000000000000-mapping.dmp
  • memory/440-255-0x0000000000000000-mapping.dmp
  • memory/440-14-0x0000000004E00000-0x0000000004E01000-memory.dmp
    Filesize

    4KB

  • memory/440-17-0x0000000000000000-mapping.dmp
  • memory/440-18-0x0000000000000000-mapping.dmp
  • memory/440-19-0x0000000000000000-mapping.dmp
  • memory/440-20-0x0000000000000000-mapping.dmp
  • memory/440-254-0x0000000000000000-mapping.dmp
  • memory/440-22-0x0000000000000000-mapping.dmp
  • memory/440-23-0x0000000000000000-mapping.dmp
  • memory/440-24-0x0000000000000000-mapping.dmp
  • memory/440-253-0x0000000000000000-mapping.dmp
  • memory/440-244-0x0000000000000000-mapping.dmp
  • memory/440-27-0x0000000000000000-mapping.dmp
  • memory/440-28-0x0000000000000000-mapping.dmp
  • memory/440-29-0x0000000000000000-mapping.dmp
  • memory/440-252-0x0000000000000000-mapping.dmp
  • memory/440-105-0x0000000000000000-mapping.dmp
  • memory/440-104-0x0000000000000000-mapping.dmp
  • memory/440-106-0x0000000000000000-mapping.dmp
  • memory/440-243-0x0000000000000000-mapping.dmp
  • memory/440-109-0x0000000000000000-mapping.dmp
  • memory/440-108-0x0000000000000000-mapping.dmp
  • memory/440-110-0x0000000000000000-mapping.dmp
  • memory/440-111-0x0000000000000000-mapping.dmp
  • memory/440-241-0x0000000000000000-mapping.dmp
  • memory/440-113-0x0000000000000000-mapping.dmp
  • memory/440-114-0x0000000000000000-mapping.dmp
  • memory/440-115-0x0000000000000000-mapping.dmp
  • memory/440-240-0x0000000000000000-mapping.dmp
  • memory/440-117-0x0000000000000000-mapping.dmp
  • memory/440-118-0x0000000000000000-mapping.dmp
  • memory/440-119-0x0000000000000000-mapping.dmp
  • memory/440-120-0x0000000000000000-mapping.dmp
  • memory/440-239-0x0000000000000000-mapping.dmp
  • memory/440-122-0x0000000000000000-mapping.dmp
  • memory/440-238-0x0000000000000000-mapping.dmp
  • memory/440-13-0x0000000004600000-0x0000000004601000-memory.dmp
    Filesize

    4KB

  • memory/440-9-0x0000000000000000-mapping.dmp
  • memory/440-126-0x0000000000000000-mapping.dmp
  • memory/440-127-0x0000000000000000-mapping.dmp
  • memory/440-128-0x0000000000000000-mapping.dmp
  • memory/440-129-0x0000000000000000-mapping.dmp
  • memory/440-124-0x0000000000000000-mapping.dmp
  • memory/440-256-0x0000000000000000-mapping.dmp
  • memory/440-132-0x0000000000000000-mapping.dmp
  • memory/440-133-0x0000000000000000-mapping.dmp
  • memory/440-250-0x0000000000000000-mapping.dmp
  • memory/440-135-0x0000000000000000-mapping.dmp
  • memory/440-138-0x0000000000000000-mapping.dmp
  • memory/440-137-0x0000000000000000-mapping.dmp
  • memory/440-136-0x0000000000000000-mapping.dmp
  • memory/440-248-0x0000000000000000-mapping.dmp
  • memory/440-140-0x0000000000000000-mapping.dmp
  • memory/440-141-0x0000000000000000-mapping.dmp
  • memory/440-142-0x0000000000000000-mapping.dmp
  • memory/440-246-0x0000000000000000-mapping.dmp
  • memory/440-247-0x0000000000000000-mapping.dmp
  • memory/440-145-0x0000000000000000-mapping.dmp
  • memory/440-144-0x0000000000000000-mapping.dmp
  • memory/440-147-0x0000000000000000-mapping.dmp
  • memory/440-146-0x0000000000000000-mapping.dmp
  • memory/440-245-0x0000000000000000-mapping.dmp
  • memory/440-150-0x0000000000000000-mapping.dmp
  • memory/440-149-0x0000000000000000-mapping.dmp
  • memory/440-151-0x0000000000000000-mapping.dmp
  • memory/440-152-0x0000000000000000-mapping.dmp
  • memory/440-155-0x0000000000000000-mapping.dmp
  • memory/440-156-0x0000000000000000-mapping.dmp
  • memory/440-157-0x0000000000000000-mapping.dmp
  • memory/440-159-0x0000000000000000-mapping.dmp
  • memory/440-158-0x0000000000000000-mapping.dmp
  • memory/440-154-0x0000000000000000-mapping.dmp
  • memory/440-251-0x0000000000000000-mapping.dmp
  • memory/440-229-0x0000000000000000-mapping.dmp
  • memory/440-230-0x0000000000000000-mapping.dmp
  • memory/440-232-0x0000000000000000-mapping.dmp
  • memory/440-231-0x0000000000000000-mapping.dmp
  • memory/440-233-0x0000000000000000-mapping.dmp
  • memory/440-123-0x0000000000000000-mapping.dmp
  • memory/440-235-0x0000000000000000-mapping.dmp
  • memory/440-236-0x0000000000000000-mapping.dmp
  • memory/440-237-0x0000000000000000-mapping.dmp
  • memory/444-234-0x0000000004800000-0x0000000004801000-memory.dmp
    Filesize

    4KB

  • memory/444-242-0x0000000005370000-0x0000000005371000-memory.dmp
    Filesize

    4KB

  • memory/840-112-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
    Filesize

    4KB

  • memory/840-107-0x0000000004240000-0x0000000004241000-memory.dmp
    Filesize

    4KB

  • memory/1596-121-0x0000000005910000-0x0000000005911000-memory.dmp
    Filesize

    4KB

  • memory/1596-116-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
    Filesize

    4KB

  • memory/2288-130-0x0000000005460000-0x0000000005461000-memory.dmp
    Filesize

    4KB

  • memory/2288-125-0x00000000047F0000-0x00000000047F1000-memory.dmp
    Filesize

    4KB

  • memory/2744-139-0x00000000055A0000-0x00000000055A1000-memory.dmp
    Filesize

    4KB

  • memory/2744-134-0x0000000004A30000-0x0000000004A31000-memory.dmp
    Filesize

    4KB

  • memory/2952-0-0x0000000000000000-mapping.dmp
  • memory/3116-249-0x0000000005010000-0x0000000005011000-memory.dmp
    Filesize

    4KB

  • memory/3168-31-0x0000000005310000-0x0000000005311000-memory.dmp
    Filesize

    4KB

  • memory/3168-25-0x00000000046A0000-0x00000000046A1000-memory.dmp
    Filesize

    4KB

  • memory/3352-21-0x0000000005960000-0x0000000005961000-memory.dmp
    Filesize

    4KB

  • memory/3352-15-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
    Filesize

    4KB

  • memory/3744-6-0x0000000000000000-mapping.dmp
  • memory/4660-148-0x0000000005A60000-0x0000000005A61000-memory.dmp
    Filesize

    4KB

  • memory/4660-143-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
    Filesize

    4KB