Analysis
- max time kernel
152s - max time network
140s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
4d31ae8690850b8b4e165b8eea9cd245.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4d31ae8690850b8b4e165b8eea9cd245.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 4d31ae8690850b8b4e165b8eea9cd245.exe
- Size 644KB
- Sample201117-sbps219ess
- SHA256 02965941d39eef787b6d2483095f7c5c6eec84a2a97ce4e85eee9e0e610506e2
- MD5 d0fc2a763157c8a866a20d7be5ec1bb4
- SHA1 cd09008ced86ef183c92bb95fedf358c83db903c
- SHA512 62eb247fbd97e3a9c27b927e3de01dd1bcc05b228cceed7da20bbff126aab7b230735399a944d687420ff2e853c4d46acc6f147e6219144cef989a6baecd5bd5
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2676 Dtumn.exe 3316 Dtumn.exe -
resource yara_rule behavioral2/memory/3984-0-0x0000000010000000-0x00000000101BC000-memory.dmp upx behavioral2/memory/2676-3-0x0000000010000000-0x00000000101BC000-memory.dmp upx behavioral2/memory/3316-7-0x0000000010000000-0x00000000101BC000-memory.dmp upx - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: Dtumn.exe File opened (read-only) \??\H: Dtumn.exe File opened (read-only) \??\O: Dtumn.exe File opened (read-only) \??\T: Dtumn.exe File opened (read-only) \??\V: Dtumn.exe File opened (read-only) \??\W: Dtumn.exe File opened (read-only) \??\E: Dtumn.exe File opened (read-only) \??\G: Dtumn.exe File opened (read-only) \??\K: Dtumn.exe File opened (read-only) \??\Q: Dtumn.exe File opened (read-only) \??\Y: Dtumn.exe File opened (read-only) \??\Z: Dtumn.exe File opened (read-only) \??\I: Dtumn.exe File opened (read-only) \??\L: Dtumn.exe File opened (read-only) \??\M: Dtumn.exe File opened (read-only) \??\P: Dtumn.exe File opened (read-only) \??\R: Dtumn.exe File opened (read-only) \??\X: Dtumn.exe File opened (read-only) \??\B: Dtumn.exe File opened (read-only) \??\J: Dtumn.exe File opened (read-only) \??\N: Dtumn.exe File opened (read-only) \??\S: Dtumn.exe File opened (read-only) \??\U: Dtumn.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Dtumn.exe 4d31ae8690850b8b4e165b8eea9cd245.exe File opened for modification C:\Windows\Dtumn.exe 4d31ae8690850b8b4e165b8eea9cd245.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Dtumn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Dtumn.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Dtumn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Dtumn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Dtumn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Dtumn.exe Key created \REGISTRY\USER\.DEFAULT\Software Dtumn.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3452 PING.EXE - Suspicious behavior: EnumeratesProcesses 66 IoCs
pid Process 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe 3316 Dtumn.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3984 4d31ae8690850b8b4e165b8eea9cd245.exe Token: 33 3316 Dtumn.exe Token: SeIncBasePriorityPrivilege 3316 Dtumn.exe Token: 33 3316 Dtumn.exe Token: SeIncBasePriorityPrivilege 3316 Dtumn.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3984 wrote to memory of 3820 3984 4d31ae8690850b8b4e165b8eea9cd245.exe 76 PID 3984 wrote to memory of 3820 3984 4d31ae8690850b8b4e165b8eea9cd245.exe 76 PID 3984 wrote to memory of 3820 3984 4d31ae8690850b8b4e165b8eea9cd245.exe 76 PID 2676 wrote to memory of 3316 2676 Dtumn.exe 78 PID 2676 wrote to memory of 3316 2676 Dtumn.exe 78 PID 2676 wrote to memory of 3316 2676 Dtumn.exe 78 PID 3820 wrote to memory of 3452 3820 cmd.exe 79 PID 3820 wrote to memory of 3452 3820 cmd.exe 79 PID 3820 wrote to memory of 3452 3820 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d31ae8690850b8b4e165b8eea9cd245.exe"C:\Users\Admin\AppData\Local\Temp\4d31ae8690850b8b4e165b8eea9cd245.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\4D31AE~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:3452
-
-
-
C:\Windows\Dtumn.exeC:\\Windows\\Dtumn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\Dtumn.exeC:\Windows\Dtumn.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316
-