Overview

overview

10

Static

static

a240f4b23b...e4.exe

windows7_x64

8

a240f4b23b...e4.exe

windows10_x64

10

Analysis

  • max time kernel
    111s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17/11/2020, 11:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a240f4b23b61460581112e9ab3754de4.exe
  • Size 208KB
  • Sample201117-rx7bycm3mn
  • SHA256 bcacc8ff565ff1c5450dbcb891ddcec02e1106edcc2ac8af7c5dc880a3aaed5a
  • MD5 SHA1 SHA512
Score
10/10
persistence

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • ServiceHost packer 18 IoCs

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE 3 IoCs
  • Drops startup file 8 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • Program crash 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 721 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a240f4b23b61460581112e9ab3754de4.exe
    "C:\Users\Admin\AppData\Local\Temp\a240f4b23b61460581112e9ab3754de4.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\POCMUZ.exe.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\windows\system\POCMUZ.exe
        C:\windows\system\POCMUZ.exe
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBTTO.exe.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\windows\SysWOW64\FBTTO.exe
            C:\windows\system32\FBTTO.exe
            5⤵
            • Executes dropped EXE
            • Drops startup file
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:1320
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 696
              6⤵
              • Suspicious use of NtCreateProcessExOtherParentProcess
              • Program crash
              • Suspicious use of AdjustPrivilegeToken
              PID:8
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 908
          4⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:2060
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\INJFN.exe.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\windows\SysWOW64\INJFN.exe
        C:\windows\system32\INJFN.exe
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:204
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 796
          4⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:3948
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 1172
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2196

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/8-41-0x00000000045D0000-0x00000000045D1000-memory.dmp
        Download

        memory/8-47-0x0000000004B00000-0x0000000004B01000-memory.dmp
        Download

        memory/2060-18-0x0000000004D00000-0x0000000004D01000-memory.dmp
        Download

        memory/2060-28-0x0000000005230000-0x0000000005231000-memory.dmp
        Download

        memory/2196-96-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
        Download

        memory/2196-97-0x0000000005200000-0x0000000005201000-memory.dmp
        Download

        memory/3948-34-0x00000000046D0000-0x00000000046D1000-memory.dmp
        Download

        memory/3948-40-0x0000000004D00000-0x0000000004D01000-memory.dmp
        Download