Analysis
- max time kernel
49s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
a2078ba859cf750820dff2cdf4431e9c.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a2078ba859cf750820dff2cdf4431e9c.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target a2078ba859cf750820dff2cdf4431e9c.exe
- Size 208KB
- Sample201117-sve1s2c7qa
- SHA256 e464444282c39c8c849b32e50864ac28b2edb9d3ccf880a65d68db1b0c3e31dc
- MD5 a2078ba859cf750820dff2cdf4431e9c
- SHA1 44cd88612b7b9b93ff8ffa82c69630412d507059
- SHA512 c2fded40823015eddcc816f2b0caf34107b1793ff9f28e136defff2e1f6f62da0730cde35799a8b7966d04b940ca075cdb36b537f93c78bf152941d5b3c53160
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
description pid Process procid_target PID 2968 created 2484 2968 WerFault.exe 67 PID 196 created 3980 196 WerFault.exe 78 PID 1180 created 1396 1180 WerFault.exe 83 - ServiceHost packer 12 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/3980-14-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-15-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-16-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-17-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-18-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-20-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-21-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-22-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3980-23-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1396-26-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1396-27-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1396-28-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 3980 ZYDTPQ.exe 1396 ZEMZNCD.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\windows\SysWOW64\ZYDTPQ.exe.bat a2078ba859cf750820dff2cdf4431e9c.exe File created C:\windows\SysWOW64\ZYDTPQ.exe a2078ba859cf750820dff2cdf4431e9c.exe File opened for modification C:\windows\SysWOW64\ZYDTPQ.exe a2078ba859cf750820dff2cdf4431e9c.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\windows\system\ZEMZNCD.exe ZYDTPQ.exe File opened for modification C:\windows\system\ZEMZNCD.exe ZYDTPQ.exe File created C:\windows\system\ZEMZNCD.exe.bat ZYDTPQ.exe - Program crash 3 IoCs
pid pid_target Process procid_target 2968 2484 WerFault.exe 67 196 3980 WerFault.exe 78 1180 1396 WerFault.exe 83 - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2484 a2078ba859cf750820dff2cdf4431e9c.exe 2484 a2078ba859cf750820dff2cdf4431e9c.exe 3980 ZYDTPQ.exe 3980 ZYDTPQ.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 2968 WerFault.exe 196 WerFault.exe 196 WerFault.exe 1396 ZEMZNCD.exe 1396 ZEMZNCD.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 2968 WerFault.exe Token: SeBackupPrivilege 2968 WerFault.exe Token: SeDebugPrivilege 2968 WerFault.exe Token: SeDebugPrivilege 196 WerFault.exe Token: SeDebugPrivilege 1180 WerFault.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2484 a2078ba859cf750820dff2cdf4431e9c.exe 2484 a2078ba859cf750820dff2cdf4431e9c.exe 3980 ZYDTPQ.exe 3980 ZYDTPQ.exe 1396 ZEMZNCD.exe 1396 ZEMZNCD.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3628 2484 a2078ba859cf750820dff2cdf4431e9c.exe 75 PID 2484 wrote to memory of 3628 2484 a2078ba859cf750820dff2cdf4431e9c.exe 75 PID 2484 wrote to memory of 3628 2484 a2078ba859cf750820dff2cdf4431e9c.exe 75 PID 3628 wrote to memory of 3980 3628 cmd.exe 78 PID 3628 wrote to memory of 3980 3628 cmd.exe 78 PID 3628 wrote to memory of 3980 3628 cmd.exe 78 PID 3980 wrote to memory of 1172 3980 ZYDTPQ.exe 80 PID 3980 wrote to memory of 1172 3980 ZYDTPQ.exe 80 PID 3980 wrote to memory of 1172 3980 ZYDTPQ.exe 80 PID 1172 wrote to memory of 1396 1172 cmd.exe 83 PID 1172 wrote to memory of 1396 1172 cmd.exe 83 PID 1172 wrote to memory of 1396 1172 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2078ba859cf750820dff2cdf4431e9c.exe"C:\Users\Admin\AppData\Local\Temp\a2078ba859cf750820dff2cdf4431e9c.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYDTPQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\SysWOW64\ZYDTPQ.exeC:\windows\system32\ZYDTPQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEMZNCD.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\windows\system\ZEMZNCD.exeC:\windows\system\ZEMZNCD.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 7806⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 9004⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:196
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 11402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968
-