Analysis
- max time kernel
50s - max time network
104s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
a4e054aba7c0e027f3d90b9f34b67196.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a4e054aba7c0e027f3d90b9f34b67196.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target a4e054aba7c0e027f3d90b9f34b67196.exe
- Size 208KB
- Sample201117-z13kgedb8a
- SHA256 bd7209d63ac38aa235209d97015d12a13a5bb1141a8bc96079d5bcef62c1b6d9
- MD5 1923d48175fc24a54abcfbf5c1a9b8ef
- SHA1 16e95a7815971eacbb4d083759efb8f500021a34
- SHA512 12167145376dfc833eac0548994b1a95b626df497141da977e7185233c4c31a2b8742a947e0b54ffc6017a5b415b00e2f961fcf0744ccabce70e096afba505ef
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
description pid Process procid_target PID 3576 created 936 3576 WerFault.exe 67 PID 4024 created 2960 4024 WerFault.exe 79 PID 220 created 964 220 WerFault.exe 83 PID 2292 created 2968 2292 WerFault.exe 80 - ServiceHost packer 9 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/2960-79-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2960-80-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2960-81-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/964-84-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/964-85-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/964-86-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2968-93-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2968-94-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2968-95-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 3 IoCs
pid Process 2960 EFXRYNY.exe 2968 RCKEHB.exe 964 UAI.exe - Drops startup file 8 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4e054aba7c0e027f3d90b9f34b67196.exe a4e054aba7c0e027f3d90b9f34b67196.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a4e054aba7c0e027f3d90b9f34b67196.exe a4e054aba7c0e027f3d90b9f34b67196.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EFXRYNY.exe EFXRYNY.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EFXRYNY.exe EFXRYNY.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RCKEHB.exe RCKEHB.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RCKEHB.exe RCKEHB.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UAI.exe UAI.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UAI.exe UAI.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecef49e3 = "C:\\windows\\SysWOW64\\EFXRYNY.exe" EFXRYNY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7aba33ab = "C:\\windows\\SysWOW64\\RCKEHB.exe" RCKEHB.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\7aba33ab = "C:\\windows\\SysWOW64\\RCKEHB.exe" RCKEHB.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\f35033f7 = "C:\\windows\\UAI.exe" UAI.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\f35033f7 = "C:\\windows\\UAI.exe" UAI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\346bea5a = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a4e054aba7c0e027f3d90b9f34b67196.exe" a4e054aba7c0e027f3d90b9f34b67196.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\346bea5a = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a4e054aba7c0e027f3d90b9f34b67196.exe" a4e054aba7c0e027f3d90b9f34b67196.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ecef49e3 = "C:\\windows\\SysWOW64\\EFXRYNY.exe" EFXRYNY.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\EFXRYNY.exe a4e054aba7c0e027f3d90b9f34b67196.exe File created C:\windows\SysWOW64\EFXRYNY.exe.bat a4e054aba7c0e027f3d90b9f34b67196.exe File created C:\windows\SysWOW64\RCKEHB.exe a4e054aba7c0e027f3d90b9f34b67196.exe File opened for modification C:\windows\SysWOW64\RCKEHB.exe a4e054aba7c0e027f3d90b9f34b67196.exe File created C:\windows\SysWOW64\RCKEHB.exe.bat a4e054aba7c0e027f3d90b9f34b67196.exe File created C:\windows\SysWOW64\EFXRYNY.exe a4e054aba7c0e027f3d90b9f34b67196.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\windows\UAI.exe a4e054aba7c0e027f3d90b9f34b67196.exe File opened for modification C:\windows\UAI.exe a4e054aba7c0e027f3d90b9f34b67196.exe File created C:\windows\UAI.exe.bat a4e054aba7c0e027f3d90b9f34b67196.exe - Program crash 4 IoCs
pid pid_target Process procid_target 3576 936 WerFault.exe 67 4024 2960 WerFault.exe 79 220 964 WerFault.exe 83 2292 2968 WerFault.exe 80 - Suspicious behavior: EnumeratesProcesses 223 IoCs
pid Process 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 964 UAI.exe 964 UAI.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 964 UAI.exe 964 UAI.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 964 UAI.exe 964 UAI.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2960 EFXRYNY.exe 964 UAI.exe 964 UAI.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 220 WerFault.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 3576 WerFault.exe Token: SeBackupPrivilege 3576 WerFault.exe Token: SeDebugPrivilege 3576 WerFault.exe Token: SeDebugPrivilege 4024 WerFault.exe Token: SeDebugPrivilege 220 WerFault.exe Token: SeDebugPrivilege 2292 WerFault.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 936 a4e054aba7c0e027f3d90b9f34b67196.exe 936 a4e054aba7c0e027f3d90b9f34b67196.exe 2960 EFXRYNY.exe 2960 EFXRYNY.exe 2968 RCKEHB.exe 2968 RCKEHB.exe 964 UAI.exe 964 UAI.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 936 wrote to memory of 3820 936 a4e054aba7c0e027f3d90b9f34b67196.exe 75 PID 936 wrote to memory of 3820 936 a4e054aba7c0e027f3d90b9f34b67196.exe 75 PID 936 wrote to memory of 3820 936 a4e054aba7c0e027f3d90b9f34b67196.exe 75 PID 936 wrote to memory of 3784 936 a4e054aba7c0e027f3d90b9f34b67196.exe 77 PID 936 wrote to memory of 3784 936 a4e054aba7c0e027f3d90b9f34b67196.exe 77 PID 936 wrote to memory of 3784 936 a4e054aba7c0e027f3d90b9f34b67196.exe 77 PID 3784 wrote to memory of 2960 3784 cmd.exe 79 PID 3784 wrote to memory of 2960 3784 cmd.exe 79 PID 3784 wrote to memory of 2960 3784 cmd.exe 79 PID 3820 wrote to memory of 2968 3820 cmd.exe 80 PID 3820 wrote to memory of 2968 3820 cmd.exe 80 PID 3820 wrote to memory of 2968 3820 cmd.exe 80 PID 936 wrote to memory of 2764 936 a4e054aba7c0e027f3d90b9f34b67196.exe 81 PID 936 wrote to memory of 2764 936 a4e054aba7c0e027f3d90b9f34b67196.exe 81 PID 936 wrote to memory of 2764 936 a4e054aba7c0e027f3d90b9f34b67196.exe 81 PID 2764 wrote to memory of 964 2764 cmd.exe 83 PID 2764 wrote to memory of 964 2764 cmd.exe 83 PID 2764 wrote to memory of 964 2764 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4e054aba7c0e027f3d90b9f34b67196.exe"C:\Users\Admin\AppData\Local\Temp\a4e054aba7c0e027f3d90b9f34b67196.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCKEHB.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\windows\SysWOW64\RCKEHB.exeC:\windows\system32\RCKEHB.exe3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 7844⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EFXRYNY.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\windows\SysWOW64\EFXRYNY.exeC:\windows\system32\EFXRYNY.exe3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 7844⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAI.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\UAI.exeC:\windows\UAI.exe3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 7804⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 11682⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3576
-