a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de

Analysis

Target
7c14e45f1b37c59138cafd3173e7acd5.exe
Size 873KB
Sample201128-615lnm96na
SHA256 a2eaa3485a9efff93e652cb5e3fef2bddaa1e631d2abc258a66f3d3b7f09f3de
MD5 7c14e45f1b37c59138cafd3173e7acd5
SHA1 7ea141eb9f013e0dce8ee2b6a692153fefbcbb3a
SHA512 52ce187cc850430f1710e898cf28a5f3a770f3a972f94f6c6c68c6e0042a5dd79b7451dbc95121dee4c0f005dbee2ccfa0aa8fc1850f3d66d7cd6c6c5a61490c
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 3 IoCs

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\brbup.job	7c14e45f1b37c59138cafd3173e7acd5.exe
File created	C:\Windows\Tasks\xixgbtrilatnlcvvnnn.job	brbup.exe
File created	C:\Windows\Tasks\iomge.job	duel.exe
File opened for modification	C:\Windows\Tasks\iomge.job	duel.exe
File created	C:\Windows\Tasks\brbup.job	7c14e45f1b37c59138cafd3173e7acd5.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1760	1704	taskeng.exe	30
PID 1704 wrote to memory of 1760	1704	taskeng.exe	30
PID 1704 wrote to memory of 1760	1704	taskeng.exe	30
PID 1704 wrote to memory of 1760	1704	taskeng.exe	30
PID 1704 wrote to memory of 1932	1704	taskeng.exe	31
PID 1704 wrote to memory of 1932	1704	taskeng.exe	31
PID 1704 wrote to memory of 1932	1704	taskeng.exe	31
PID 1704 wrote to memory of 1932	1704	taskeng.exe	31
PID 1704 wrote to memory of 568	1704	taskeng.exe	32
PID 1704 wrote to memory of 568	1704	taskeng.exe	32
PID 1704 wrote to memory of 568	1704	taskeng.exe	32
PID 1704 wrote to memory of 568	1704	taskeng.exe	32

C:\Users\Admin\AppData\Local\Temp\7c14e45f1b37c59138cafd3173e7acd5.exe
"C:\Users\Admin\AppData\Local\Temp\7c14e45f1b37c59138cafd3173e7acd5.exe"
1⤵
- Drops file in Windows directory
PID:2012

C:\Windows\system32\taskeng.exe
taskeng.exe {9E929D6D-503F-4B56-AD2C-2528D3EA0A8D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\ProgramData\rjrx\brbup.exe
  C:\ProgramData\rjrx\brbup.exe start
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1760
- C:\Windows\TEMP\duel.exe
  C:\Windows\TEMP\duel.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1932
- C:\ProgramData\enqupk\iomge.exe
  C:\ProgramData\enqupk\iomge.exe start
  2⤵
  - Executes dropped EXE
  PID:568