Analysis
- max time kernel
150s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/12/2020, 04:40
Static task
static1
Behavioral task
behavioral1
Sample
Scan- PO 20-136AR.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Scan- PO 20-136AR.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Scan- PO 20-136AR.exe
- Size 1.8MB
- Sample201208-bwaswt6qzj
- SHA256 56223f30d25ad9e7ace44f33bf080b1b965df0a8d4f0b298537d9dcda4162052
- MD5 6dd5fda94033113ebb61f8947adc4272
- SHA1 3e3ee8ea240edbc047f775b3870f4d2a87dbe771
- SHA512 e62418e2f945e54e93e57801d593054793892b90c8d8a1c45f15ea196f171c558fc30ab3109f08feb1435fe0c078641ae7f4e9d585cc1a583e7fb92b79c37942
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
resource yara_rule behavioral2/memory/4692-8-0x00000000060F0000-0x00000000062A3000-memory.dmp beds_protector - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan- PO 20-136AR.exe Scan- PO 20-136AR.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scan- PO 20-136AR.exe Scan- PO 20-136AR.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 576 Scan- PO 20-136AR.exe 576 Scan- PO 20-136AR.exe 576 Scan- PO 20-136AR.exe 576 Scan- PO 20-136AR.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4692 set thread context of 576 4692 Scan- PO 20-136AR.exe 78 - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe 4692 Scan- PO 20-136AR.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4692 Scan- PO 20-136AR.exe Token: SeShutdownPrivilege 576 Scan- PO 20-136AR.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 576 Scan- PO 20-136AR.exe 576 Scan- PO 20-136AR.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78 PID 4692 wrote to memory of 576 4692 Scan- PO 20-136AR.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan- PO 20-136AR.exe"C:\Users\Admin\AppData\Local\Temp\Scan- PO 20-136AR.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\Scan- PO 20-136AR.exe"C:\Users\Admin\AppData\Local\Temp\Scan- PO 20-136AR.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:576
-