dbb052cb64caf28728eecf651c6c50340d246842e875960f990ff40016da979c

Analysis

max time kernel
149s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
22/12/2020, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aacfb5db7ad135489ed672b5940cbd43.exe
Size 1.5MB
Sample201222-zyb8llryha
SHA256 dbb052cb64caf28728eecf651c6c50340d246842e875960f990ff40016da979c
MD5 aacfb5db7ad135489ed672b5940cbd43
SHA1 5aa7999c8ce0af9372362024a2dc8fa156da311f
SHA512 f9b582e5961607172f70b21260d39773c7a3a0f5df205dd2e20610521c2d8470c38b3c01e7f1c605de7c8b598bda7776f6e1d3c699421d958780b7fcf729283b
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3752	csrss.exe
3904	csrss.exe
2272	csrss.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 3752 set thread context of 2272	3752	csrss.exe	96

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\svchost.exe	aacfb5db7ad135489ed672b5940cbd43.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\f4d236fdec2fd03914189c3b26e5cb0dfea9d761	aacfb5db7ad135489ed672b5940cbd43.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3928	schtasks.exe
2264	schtasks.exe
3816	schtasks.exe
208	schtasks.exe
2796	schtasks.exe
1716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3000	aacfb5db7ad135489ed672b5940cbd43.exe
3000	aacfb5db7ad135489ed672b5940cbd43.exe
752	aacfb5db7ad135489ed672b5940cbd43.exe
3752	csrss.exe
3752	csrss.exe
2272	csrss.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	aacfb5db7ad135489ed672b5940cbd43.exe
Token: SeDebugPrivilege	752	aacfb5db7ad135489ed672b5940cbd43.exe
Token: SeDebugPrivilege	3752	csrss.exe
Token: SeDebugPrivilege	2272	csrss.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3132	3000	aacfb5db7ad135489ed672b5940cbd43.exe	79
PID 3000 wrote to memory of 3132	3000	aacfb5db7ad135489ed672b5940cbd43.exe	79
PID 3000 wrote to memory of 3132	3000	aacfb5db7ad135489ed672b5940cbd43.exe	79
PID 3000 wrote to memory of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 3000 wrote to memory of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 3000 wrote to memory of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 3000 wrote to memory of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 3000 wrote to memory of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 3000 wrote to memory of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 3000 wrote to memory of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 3000 wrote to memory of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 3000 wrote to memory of 752	3000	aacfb5db7ad135489ed672b5940cbd43.exe	80
PID 752 wrote to memory of 1716	752	aacfb5db7ad135489ed672b5940cbd43.exe	82
PID 752 wrote to memory of 1716	752	aacfb5db7ad135489ed672b5940cbd43.exe	82
PID 752 wrote to memory of 1716	752	aacfb5db7ad135489ed672b5940cbd43.exe	82
PID 752 wrote to memory of 3928	752	aacfb5db7ad135489ed672b5940cbd43.exe	84
PID 752 wrote to memory of 3928	752	aacfb5db7ad135489ed672b5940cbd43.exe	84
PID 752 wrote to memory of 3928	752	aacfb5db7ad135489ed672b5940cbd43.exe	84
PID 752 wrote to memory of 2264	752	aacfb5db7ad135489ed672b5940cbd43.exe	86
PID 752 wrote to memory of 2264	752	aacfb5db7ad135489ed672b5940cbd43.exe	86
PID 752 wrote to memory of 2264	752	aacfb5db7ad135489ed672b5940cbd43.exe	86
PID 752 wrote to memory of 3816	752	aacfb5db7ad135489ed672b5940cbd43.exe	88
PID 752 wrote to memory of 3816	752	aacfb5db7ad135489ed672b5940cbd43.exe	88
PID 752 wrote to memory of 3816	752	aacfb5db7ad135489ed672b5940cbd43.exe	88
PID 752 wrote to memory of 208	752	aacfb5db7ad135489ed672b5940cbd43.exe	90
PID 752 wrote to memory of 208	752	aacfb5db7ad135489ed672b5940cbd43.exe	90
PID 752 wrote to memory of 208	752	aacfb5db7ad135489ed672b5940cbd43.exe	90
PID 752 wrote to memory of 2796	752	aacfb5db7ad135489ed672b5940cbd43.exe	92
PID 752 wrote to memory of 2796	752	aacfb5db7ad135489ed672b5940cbd43.exe	92
PID 752 wrote to memory of 2796	752	aacfb5db7ad135489ed672b5940cbd43.exe	92
PID 752 wrote to memory of 3752	752	aacfb5db7ad135489ed672b5940cbd43.exe	94
PID 752 wrote to memory of 3752	752	aacfb5db7ad135489ed672b5940cbd43.exe	94
PID 752 wrote to memory of 3752	752	aacfb5db7ad135489ed672b5940cbd43.exe	94
PID 3752 wrote to memory of 3904	3752	csrss.exe	95
PID 3752 wrote to memory of 3904	3752	csrss.exe	95
PID 3752 wrote to memory of 3904	3752	csrss.exe	95
PID 3752 wrote to memory of 2272	3752	csrss.exe	96
PID 3752 wrote to memory of 2272	3752	csrss.exe	96
PID 3752 wrote to memory of 2272	3752	csrss.exe	96
PID 3752 wrote to memory of 2272	3752	csrss.exe	96
PID 3752 wrote to memory of 2272	3752	csrss.exe	96
PID 3752 wrote to memory of 2272	3752	csrss.exe	96
PID 3752 wrote to memory of 2272	3752	csrss.exe	96
PID 3752 wrote to memory of 2272	3752	csrss.exe	96
PID 3752 wrote to memory of 2272	3752	csrss.exe	96

C:\Users\Admin\AppData\Local\Temp\aacfb5db7ad135489ed672b5940cbd43.exe
"C:\Users\Admin\AppData\Local\Temp\aacfb5db7ad135489ed672b5940cbd43.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\aacfb5db7ad135489ed672b5940cbd43.exe
  "C:\Users\Admin\AppData\Local\Temp\aacfb5db7ad135489ed672b5940cbd43.exe"
  2⤵
  PID:3132
- C:\Users\Admin\AppData\Local\Temp\aacfb5db7ad135489ed672b5940cbd43.exe
  "C:\Users\Admin\AppData\Local\Temp\aacfb5db7ad135489ed672b5940cbd43.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1716
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\svchost.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3928
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "aacfb5db7ad135489ed672b5940cbd43" /sc ONLOGON /tr "'C:\Documents and Settings\aacfb5db7ad135489ed672b5940cbd43.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2264
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Users\Public\Music\svchost.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3816
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\svchost.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:208
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2796
- - C:\Users\Admin\csrss.exe
    "C:\Users\Admin\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Users\Admin\csrss.exe
      "C:\Users\Admin\csrss.exe"
      4⤵
      Executes dropped EXE
      PID:3904
  - - C:\Users\Admin\csrss.exe
      "C:\Users\Admin\csrss.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-17-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/752-21-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/752-14-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/2272-50-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/3000-10-0x00000000468E0000-0x0000000046A1F000-memory.dmp

Download

memory/3000-8-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/3000-3-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/3000-13-0x0000000046B10000-0x0000000046C38000-memory.dmp

Download

memory/3000-11-0x0000000005160000-0x0000000005168000-memory.dmp

Download

memory/3000-5-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

memory/3000-2-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/3000-6-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/3000-9-0x0000000026330000-0x0000000046318000-memory.dmp

Download

memory/3000-7-0x0000000005030000-0x0000000005031000-memory.dmp

Download

memory/3752-36-0x0000000005A00000-0x0000000005A01000-memory.dmp

Download

memory/3752-33-0x0000000073920000-0x000000007400E000-memory.dmp

Download