Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
6ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10Resubmissions
24-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 1024-07-2023 06:25
230724-g6s6laag35 1022-07-2023 15:57
230722-tee6wabg5w 1020-07-2023 23:19
230720-3bb5gsbf5v 1020-07-2023 23:06
230720-23f23sba63 1003-02-2021 11:43
210203-6bgge2nfan 1022-11-2020 06:42
201122-6x1at779dj 10Analysis
-
max time kernel
1810s -
max time network
1795s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-11-2020 06:42
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@000.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Endermanch@7ev3n.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Endermanch@AnViPC2009.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Endermanch@Antivirus.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Endermanch@AntivirusPlatinum.exe
Resource
win10v20201028
Behavioral task
behavioral6
Sample
Endermanch@AntivirusPro2017.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
Endermanch@BadRabbit.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
Endermanch@Birele.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
Endermanch@Cerber5.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
Endermanch@CleanThis.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
Endermanch@ColorBug.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
Endermanch@DeriaLock.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Endermanch@Deskbottom.exe
Resource
win10v20201028
Behavioral task
behavioral14
Sample
Endermanch@DesktopPuzzle.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
Endermanch@HMBlocker.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
Endermanch@HappyAntivirus.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
Endermanch@Illerka.C.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
Endermanch@Koteyka2.exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
Endermanch@LPS2019.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
Endermanch@Movie.mpeg.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
Endermanch@NavaShield(1).exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
Endermanch@NavaShield.exe
Resource
win10v20201028
Behavioral task
behavioral26
Sample
Endermanch@PCDefender.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
Endermanch@PCDefenderv2.msi
Resource
win10v20201028
Behavioral task
behavioral28
Sample
Endermanch@PolyRansom.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
Endermanch@PowerPoint.exe
Resource
win10v20201028
Behavioral task
behavioral30
Sample
Endermanch@ProgramOverflow.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
Endermanch@RegistrySmart.exe
Resource
win10v20201028
Behavioral task
behavioral32
Sample
Endermanch@SE2011.exe
Resource
win10v20201028
General
-
Target
Endermanch@Antivirus.exe
-
Size
2.0MB
-
MD5
c7e9746b1b039b8bd1106bca3038c38f
-
SHA1
cb93ac887876bafe39c5f9aa64970d5e747fb191
-
SHA256
b1369bd254d96f7966047ad4be06103830136629590182d49e5cb8680529ebd4
-
SHA512
cf5d688f1aec8ec65c1cb91d367da9a96911640c695d5c2d023836ef11e374ff158c152b4b6207e8fcdb5ccf0eed79741e080f1cbc915fe0af3dacd624525724
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Endermanch@Antivirus.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run Endermanch@Antivirus.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan" Endermanch@Antivirus.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Endermanch@Antivirus.exedescription ioc process File created C:\Program Files (x86)\AnVi\virus.mp3 Endermanch@Antivirus.exe File created C:\Program Files (x86)\AnVi\splash.mp3 Endermanch@Antivirus.exe -
Processes:
Endermanch@Antivirus.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main Endermanch@Antivirus.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" Endermanch@Antivirus.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20304 IoCs
Processes:
Endermanch@Antivirus.exepid process 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mofcomp.exedescription pid process Token: SeSecurityPrivilege 4092 mofcomp.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Endermanch@Antivirus.exepid process 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Endermanch@Antivirus.exepid process 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
Endermanch@Antivirus.exepid process 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe 1404 Endermanch@Antivirus.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
Endermanch@Antivirus.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1404 wrote to memory of 808 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 808 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 808 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 3560 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 3560 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 3560 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 852 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 852 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 852 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 1316 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 1316 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 1316 1404 Endermanch@Antivirus.exe net.exe PID 1404 wrote to memory of 4092 1404 Endermanch@Antivirus.exe mofcomp.exe PID 1404 wrote to memory of 4092 1404 Endermanch@Antivirus.exe mofcomp.exe PID 1404 wrote to memory of 4092 1404 Endermanch@Antivirus.exe mofcomp.exe PID 1316 wrote to memory of 3340 1316 net.exe net1.exe PID 1316 wrote to memory of 3340 1316 net.exe net1.exe PID 1316 wrote to memory of 3340 1316 net.exe net1.exe PID 808 wrote to memory of 3844 808 net.exe net1.exe PID 808 wrote to memory of 3844 808 net.exe net1.exe PID 808 wrote to memory of 3844 808 net.exe net1.exe PID 3560 wrote to memory of 3916 3560 net.exe net1.exe PID 3560 wrote to memory of 3916 3560 net.exe net1.exe PID 3560 wrote to memory of 3916 3560 net.exe net1.exe PID 852 wrote to memory of 3732 852 net.exe net1.exe PID 852 wrote to memory of 3732 852 net.exe net1.exe PID 852 wrote to memory of 3732 852 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@Antivirus.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@Antivirus.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop wscsvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc3⤵
-
C:\Windows\SysWOW64\net.exenet stop winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵
-
C:\Windows\SysWOW64\net.exenet start winmgmt2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start winmgmt3⤵
-
C:\Windows\SysWOW64\net.exenet start wscsvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start wscsvc3⤵
-
C:\Windows\SysWOW64\Wbem\mofcomp.exemofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4otjesjty.mofMD5
7fad92afda308dca8acfc6ff45c80c24
SHA1a7fa35e7f90f772fc943c2e940737a48b654c295
SHA25676e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f
SHA51249eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea
-
memory/808-0-0x0000000000000000-mapping.dmp
-
memory/852-2-0x0000000000000000-mapping.dmp
-
memory/1316-3-0x0000000000000000-mapping.dmp
-
memory/3340-5-0x0000000000000000-mapping.dmp
-
memory/3560-1-0x0000000000000000-mapping.dmp
-
memory/3732-8-0x0000000000000000-mapping.dmp
-
memory/3844-6-0x0000000000000000-mapping.dmp
-
memory/3916-7-0x0000000000000000-mapping.dmp
-
memory/4092-4-0x0000000000000000-mapping.dmp