Behavioral Report

Resubmissions

19-01-2021 19:24

210119-s26yznnqsn 10

19-11-2020 13:14

201119-s41ec6lt86 10

Analysis

max time kernel
1729s
max time network
1745s
platform
windows10_x64
resource
win10v20201028
submitted
19-11-2020 13:14

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

6a9e7107c97762eb1196a64baeadb291.exe

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

Processes:

msiexec.exe

flow pid process

34 2704 msiexec.exe
36 2704 msiexec.exe
61 2704 msiexec.exe
80 2704 msiexec.exe
195 2704 msiexec.exe

flow	pid	process
34	2704	msiexec.exe
36	2704	msiexec.exe
61	2704	msiexec.exe
80	2704	msiexec.exe
195	2704	msiexec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

TTPs:

Registry Run Keys / Startup Folder Modify Registry

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fuekl = "C:\\Users\\Admin\\AppData\\Roaming\\Xybe\\izqatec.exe"	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6a9e7107c97762eb1196a64baeadb291.exe

description pid process target process

PID 3772 set thread context of 2704 3772 6a9e7107c97762eb1196a64baeadb291.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 2704 msiexec.exe
Token: SeSecurityPrivilege 2704 msiexec.exe

description	pid	process	target process
PID 3772 set thread context of 2704	3772	6a9e7107c97762eb1196a64baeadb291.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	2704	msiexec.exe
Token: SeSecurityPrivilege	2704	msiexec.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

6a9e7107c97762eb1196a64baeadb291.exe

description	pid	process	target process
PID 3772 wrote to memory of 2704	3772	6a9e7107c97762eb1196a64baeadb291.exe	msiexec.exe
PID 3772 wrote to memory of 2704	3772	6a9e7107c97762eb1196a64baeadb291.exe	msiexec.exe
PID 3772 wrote to memory of 2704	3772	6a9e7107c97762eb1196a64baeadb291.exe	msiexec.exe
PID 3772 wrote to memory of 2704	3772	6a9e7107c97762eb1196a64baeadb291.exe	msiexec.exe
PID 3772 wrote to memory of 2704	3772	6a9e7107c97762eb1196a64baeadb291.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\6a9e7107c97762eb1196a64baeadb291.exe

"C:\Users\Admin\AppData\Local\Temp\6a9e7107c97762eb1196a64baeadb291.exe"

Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory

PID:3772

C:\Windows\SysWOW64\msiexec.exe

msiexec.exe

Blocklisted process makes network request
Adds Run key to start application
Suspicious use of AdjustPrivilegeToken

PID:2704

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

T1112

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

memory/2704-3-0x0000000000000000-mapping.dmp

Download
memory/2704-2-0x0000000002DB0000-0x0000000002DD6000-memory.dmp

Filesize
152KB

Download
memory/3772-0-0x0000000003296000-0x0000000003297000-memory.dmp

Filesize
4KB

Download
memory/3772-1-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download