a9af2bddccc4126a93f8b0a3413df57fd0f70d8829c8cba61c8aae21c07423f6

Resubmissions

07/12/2020, 20:04

201207-w81wzhv95x10

07/12/2020, 19:23

201207-qmmnf11ps68

Analysis

max time kernel
118s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
07/12/2020, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26d653f5009eeb0b96fadeb380075af5.exe
Size 1.0MB
Sample201207-qmmnf11ps6
SHA256 a9af2bddccc4126a93f8b0a3413df57fd0f70d8829c8cba61c8aae21c07423f6
MD5 26d653f5009eeb0b96fadeb380075af5
SHA1 429c58a9a83e573c48ca010d076ba78e42133a37
SHA512 6f01af71356acb3439c94484c0a1c4d94f73b8c2435fee47f402fa0ae1d0417bd0bd13441aa86e63fe75657da420f16b4d7a5ce1a80e29024c4e53407f3fa1ec
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	26d653f5009eeb0b96fadeb380075af5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\kprUEGC = "C:\\Users\\Admin\\AppData\\Roaming\\kprUEGC\\kprUEGC.exe"	26d653f5009eeb0b96fadeb380075af5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 500 set thread context of 3568	500	26d653f5009eeb0b96fadeb380075af5.exe	79

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
500	26d653f5009eeb0b96fadeb380075af5.exe
500	26d653f5009eeb0b96fadeb380075af5.exe
500	26d653f5009eeb0b96fadeb380075af5.exe
3568	26d653f5009eeb0b96fadeb380075af5.exe
3568	26d653f5009eeb0b96fadeb380075af5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	500	26d653f5009eeb0b96fadeb380075af5.exe
Token: SeDebugPrivilege	3568	26d653f5009eeb0b96fadeb380075af5.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 500 wrote to memory of 200	500	26d653f5009eeb0b96fadeb380075af5.exe	78
PID 500 wrote to memory of 200	500	26d653f5009eeb0b96fadeb380075af5.exe	78
PID 500 wrote to memory of 200	500	26d653f5009eeb0b96fadeb380075af5.exe	78
PID 500 wrote to memory of 3568	500	26d653f5009eeb0b96fadeb380075af5.exe	79
PID 500 wrote to memory of 3568	500	26d653f5009eeb0b96fadeb380075af5.exe	79
PID 500 wrote to memory of 3568	500	26d653f5009eeb0b96fadeb380075af5.exe	79
PID 500 wrote to memory of 3568	500	26d653f5009eeb0b96fadeb380075af5.exe	79
PID 500 wrote to memory of 3568	500	26d653f5009eeb0b96fadeb380075af5.exe	79
PID 500 wrote to memory of 3568	500	26d653f5009eeb0b96fadeb380075af5.exe	79
PID 500 wrote to memory of 3568	500	26d653f5009eeb0b96fadeb380075af5.exe	79
PID 500 wrote to memory of 3568	500	26d653f5009eeb0b96fadeb380075af5.exe	79

C:\Users\Admin\AppData\Local\Temp\26d653f5009eeb0b96fadeb380075af5.exe
"C:\Users\Admin\AppData\Local\Temp\26d653f5009eeb0b96fadeb380075af5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:500
- C:\Users\Admin\AppData\Local\Temp\26d653f5009eeb0b96fadeb380075af5.exe
  "C:\Users\Admin\AppData\Local\Temp\26d653f5009eeb0b96fadeb380075af5.exe"
  2⤵
  PID:200
- C:\Users\Admin\AppData\Local\Temp\26d653f5009eeb0b96fadeb380075af5.exe
  "C:\Users\Admin\AppData\Local\Temp\26d653f5009eeb0b96fadeb380075af5.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/500-2-0x0000000073560000-0x0000000073C4E000-memory.dmp

Download

memory/500-3-0x00000000004D0000-0x00000000004D1000-memory.dmp

Download

memory/500-5-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/500-6-0x0000000005400000-0x0000000005401000-memory.dmp

Download

memory/500-7-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/500-8-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download

memory/500-9-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/500-10-0x00000000262E0000-0x00000000462C8000-memory.dmp

Download

memory/500-11-0x00000000466D0000-0x0000000046765000-memory.dmp

Download

memory/500-12-0x0000000046560000-0x0000000046568000-memory.dmp

Download

memory/500-14-0x0000000046860000-0x00000000468D7000-memory.dmp

Download

memory/3568-15-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3568-17-0x0000000073560000-0x0000000073C4E000-memory.dmp

Download

memory/3568-22-0x00000000053A0000-0x00000000053A1000-memory.dmp

Download

memory/3568-23-0x0000000005F20000-0x0000000005F21000-memory.dmp

Download