Analysis
-
max time kernel
25s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-12-2020 10:28
Static task
static1
Behavioral task
behavioral1
Sample
a57c8822899013c8d0bbd87b4c36821a.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a57c8822899013c8d0bbd87b4c36821a.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
a57c8822899013c8d0bbd87b4c36821a.exe
-
Size
341KB
-
MD5
a57c8822899013c8d0bbd87b4c36821a
-
SHA1
54da561ef6e0d2c368aca185ee828d67543fbf9e
-
SHA256
ddb95e81345469771c505272274d21eb2e317ed8c46e0b679362df7cbf52ba6c
-
SHA512
e070796a826d125787f875a587ada069799507f6fe842f05c5963d9080ee255b5a2d7097f996cfb19f9b08120beb6b47f722e17d3818ee09accdc5ae3354d247
Score
9/10
Malware Config
Signatures
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
resource yara_rule behavioral2/memory/3988-9-0x0000000005AF0000-0x0000000005B3B000-memory.dmp beds_protector -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a57c8822899013c8d0bbd87b4c36821a.exe a57c8822899013c8d0bbd87b4c36821a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a57c8822899013c8d0bbd87b4c36821a.exe a57c8822899013c8d0bbd87b4c36821a.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3988 set thread context of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79 -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe 3988 a57c8822899013c8d0bbd87b4c36821a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3988 a57c8822899013c8d0bbd87b4c36821a.exe Token: SeDebugPrivilege 3996 a57c8822899013c8d0bbd87b4c36821a.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3988 wrote to memory of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79 PID 3988 wrote to memory of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79 PID 3988 wrote to memory of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79 PID 3988 wrote to memory of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79 PID 3988 wrote to memory of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79 PID 3988 wrote to memory of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79 PID 3988 wrote to memory of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79 PID 3988 wrote to memory of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79 PID 3988 wrote to memory of 3996 3988 a57c8822899013c8d0bbd87b4c36821a.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\a57c8822899013c8d0bbd87b4c36821a.exe"C:\Users\Admin\AppData\Local\Temp\a57c8822899013c8d0bbd87b4c36821a.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\a57c8822899013c8d0bbd87b4c36821a.exe"C:\Users\Admin\AppData\Local\Temp\a57c8822899013c8d0bbd87b4c36821a.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3996
-