712a574efe405aa7179c364b1536d575acb75e12f0f558ce5949e254ddb52e8d

Analysis

max time kernel
145s
max time network
145s
platform
windows10_x64
resource
win10v20201028
submitted
04/12/2020, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe
Size 545KB
Sample201204-8d6m259et6
SHA256 712a574efe405aa7179c364b1536d575acb75e12f0f558ce5949e254ddb52e8d
MD5 f7291a15cba2ec4a3d7a7a0e6a0c9b0d
SHA1 a85cb8058485d4983883f434afdcbc7963c004b8
SHA512 5d76933848f89b9be95b89d2948e56999b07aa4d12aadd85c525959beebc6fbdb94ae8debb44f794cb5751f909af5bd42941c814ee33ecb0bd64ba384f167049
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blacklisted process makes network request 2 IoCs

flow	pid	Process
18	1540	rundll32.exe
21	4048	rundll32.exe

Executes dropped EXE 8 IoCs

pid	Process
2964	gbudn.exe
3896	gbudn.exe
3292	gbudn.exe
3784	gbudn.exe
3436	gbudn.exe
2828	gbudn.exe
1972	gbudn.exe
184	gbudn.exe

Loads dropped DLL 7 IoCs

pid	Process
3928	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe
2964	gbudn.exe
3292	gbudn.exe
1540	rundll32.exe
4048	rundll32.exe
3436	gbudn.exe
1972	gbudn.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3928 set thread context of 2404	3928	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe	78
PID 2964 set thread context of 3896	2964	gbudn.exe	80
PID 3292 set thread context of 3784	3292	gbudn.exe	84
PID 3436 set thread context of 2828	3436	gbudn.exe	88
PID 1972 set thread context of 184	1972	gbudn.exe	90

NSIS installer 18 IoCs

installer

resource	yara_rule
behavioral2/files/0x000100000001ab66-8.dat	nsis_installer_1
behavioral2/files/0x000100000001ab66-8.dat	nsis_installer_2
behavioral2/files/0x000100000001ab66-9.dat	nsis_installer_1
behavioral2/files/0x000100000001ab66-9.dat	nsis_installer_2
behavioral2/files/0x000100000001ab66-14.dat	nsis_installer_1
behavioral2/files/0x000100000001ab66-14.dat	nsis_installer_2
behavioral2/files/0x000100000001ab66-19.dat	nsis_installer_1
behavioral2/files/0x000100000001ab66-19.dat	nsis_installer_2
behavioral2/files/0x000100000001ab66-24.dat	nsis_installer_1
behavioral2/files/0x000100000001ab66-24.dat	nsis_installer_2
behavioral2/files/0x000100000001ab66-34.dat	nsis_installer_1
behavioral2/files/0x000100000001ab66-34.dat	nsis_installer_2
behavioral2/files/0x000100000001ab66-39.dat	nsis_installer_1
behavioral2/files/0x000100000001ab66-39.dat	nsis_installer_2
behavioral2/files/0x000100000001ab66-43.dat	nsis_installer_1
behavioral2/files/0x000100000001ab66-43.dat	nsis_installer_2
behavioral2/files/0x000100000001ab66-48.dat	nsis_installer_1
behavioral2/files/0x000100000001ab66-48.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1540	rundll32.exe
1540	rundll32.exe
1540	rundll32.exe
1540	rundll32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3928	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe
2964	gbudn.exe
3292	gbudn.exe
3436	gbudn.exe
1972	gbudn.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 2404	3928	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe	78
PID 3928 wrote to memory of 2404	3928	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe	78
PID 3928 wrote to memory of 2404	3928	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe	78
PID 3928 wrote to memory of 2404	3928	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe	78
PID 2404 wrote to memory of 2964	2404	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe	79
PID 2404 wrote to memory of 2964	2404	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe	79
PID 2404 wrote to memory of 2964	2404	f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe	79
PID 2964 wrote to memory of 3896	2964	gbudn.exe	80
PID 2964 wrote to memory of 3896	2964	gbudn.exe	80
PID 2964 wrote to memory of 3896	2964	gbudn.exe	80
PID 2964 wrote to memory of 3896	2964	gbudn.exe	80
PID 3896 wrote to memory of 1456	3896	gbudn.exe	81
PID 3896 wrote to memory of 1456	3896	gbudn.exe	81
PID 3896 wrote to memory of 1456	3896	gbudn.exe	81
PID 3292 wrote to memory of 3784	3292	gbudn.exe	84
PID 3292 wrote to memory of 3784	3292	gbudn.exe	84
PID 3292 wrote to memory of 3784	3292	gbudn.exe	84
PID 3292 wrote to memory of 3784	3292	gbudn.exe	84
PID 3896 wrote to memory of 1540	3896	gbudn.exe	85
PID 3896 wrote to memory of 1540	3896	gbudn.exe	85
PID 3896 wrote to memory of 1540	3896	gbudn.exe	85
PID 3896 wrote to memory of 4048	3896	gbudn.exe	86
PID 3896 wrote to memory of 4048	3896	gbudn.exe	86
PID 3896 wrote to memory of 4048	3896	gbudn.exe	86
PID 3436 wrote to memory of 2828	3436	gbudn.exe	88
PID 3436 wrote to memory of 2828	3436	gbudn.exe	88
PID 3436 wrote to memory of 2828	3436	gbudn.exe	88
PID 3436 wrote to memory of 2828	3436	gbudn.exe	88
PID 1972 wrote to memory of 184	1972	gbudn.exe	90
PID 1972 wrote to memory of 184	1972	gbudn.exe	90
PID 1972 wrote to memory of 184	1972	gbudn.exe	90
PID 1972 wrote to memory of 184	1972	gbudn.exe	90

C:\Users\Admin\AppData\Local\Temp\f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe
"C:\Users\Admin\AppData\Local\Temp\f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Users\Admin\AppData\Local\Temp\f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe
  "C:\Users\Admin\AppData\Local\Temp\f7291a15cba2ec4a3d7a7a0e6a0c9b0d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\ProgramData\89da14dd9f\gbudn.exe
    "C:\ProgramData\89da14dd9f\gbudn.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\ProgramData\89da14dd9f\gbudn.exe
      "C:\ProgramData\89da14dd9f\gbudn.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gbudn.exe /TR "C:\ProgramData\89da14dd9f\gbudn.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1456
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\ProgramData\89da14dd9f\cred.dll, Main
        5⤵
        Blacklisted process makes network request
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1540
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\ProgramData\89da14dd9f\scr.dll, Main
        5⤵
        Blacklisted process makes network request
        Loads dropped DLL
        
        PID:4048

C:\ProgramData\89da14dd9f\gbudn.exe
C:\ProgramData\89da14dd9f\gbudn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3292
- C:\ProgramData\89da14dd9f\gbudn.exe
  C:\ProgramData\89da14dd9f\gbudn.exe
  2⤵
  - Executes dropped EXE
  PID:3784

C:\ProgramData\89da14dd9f\gbudn.exe
C:\ProgramData\89da14dd9f\gbudn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3436
- C:\ProgramData\89da14dd9f\gbudn.exe
  C:\ProgramData\89da14dd9f\gbudn.exe
  2⤵
  - Executes dropped EXE
  PID:2828

C:\ProgramData\89da14dd9f\gbudn.exe
C:\ProgramData\89da14dd9f\gbudn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1972
- C:\ProgramData\89da14dd9f\gbudn.exe
  C:\ProgramData\89da14dd9f\gbudn.exe
  2⤵
  - Executes dropped EXE
  PID:184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/184-49-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2404-6-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2404-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2828-40-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2964-16-0x0000000002770000-0x00000000027A1000-memory.dmp

Download

memory/3784-26-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3896-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3928-5-0x0000000000AC0000-0x0000000000AF1000-memory.dmp

Download