Overview

overview

10

Static

static

a17595e990...23.exe

windows7_x64

8

a17595e990...23.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17/11/2020, 11:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a17595e9904acc27d06956f1698f6023.exe
  • Size 208KB
  • Sample201117-wcj3pfzzbs
  • SHA256 784c771b4eeaaf909fba8a13576fa117604ce9bc5e6131b9352888ba6aed77a7
  • MD5 SHA1 SHA512
Score
10/10
persistence

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • ServiceHost packer 13 IoCs

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE 4 IoCs
  • Drops startup file 10 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 6 IoCs
  • Program crash 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1215 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a17595e9904acc27d06956f1698f6023.exe
    "C:\Users\Admin\AppData\Local\Temp\a17595e9904acc27d06956f1698f6023.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\DLMYZV.exe.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4240
      • C:\windows\DLMYZV.exe
        C:\windows\DLMYZV.exe
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:748
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\windows\system32\RBUEC.exe.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:416
          • C:\windows\SysWOW64\RBUEC.exe
            C:\windows\system32\RBUEC.exe
            5⤵
            • Executes dropped EXE
            • Drops startup file
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:684
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 780
              6⤵
              • Suspicious use of NtCreateProcessExOtherParentProcess
              • Program crash
              • Suspicious use of AdjustPrivilegeToken
              PID:4052
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\DZSMY.exe.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\windows\SysWOW64\DZSMY.exe
        C:\windows\system32\DZSMY.exe
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4028
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 800
          4⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:4088
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system\BXGXBA.exe.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4196
      • C:\windows\system\BXGXBA.exe
        C:\windows\system\BXGXBA.exe
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:648
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 696
          4⤵
          • Suspicious use of NtCreateProcessExOtherParentProcess
          • Program crash
          • Suspicious use of AdjustPrivilegeToken
          PID:4640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1148
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2432

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/2432-25-0x0000000005000000-0x0000000005001000-memory.dmp
        Download

        memory/2432-24-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
        Download

        memory/4052-39-0x0000000005000000-0x0000000005001000-memory.dmp
        Download

        memory/4052-33-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
        Download

        memory/4088-32-0x0000000004B00000-0x0000000004B01000-memory.dmp
        Download

        memory/4088-26-0x00000000045D0000-0x00000000045D1000-memory.dmp
        Download

        memory/4640-40-0x0000000004E20000-0x0000000004E21000-memory.dmp
        Download