Analysis
- max time kernel
150s - max time network
125s - platform
windows10_x64 - resource
win10v20201028 - submitted
25/12/2020, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
ad416d58aa5a4a822803554204a0085b.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ad416d58aa5a4a822803554204a0085b.dll
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target ad416d58aa5a4a822803554204a0085b.dll
- Size 1.2MB
- Sample201225-5x1byryvc6
- SHA256 d19b02a35003c637360cc342d5fcdae87dc7336fc7925f07f5c0636eae22ba37
- MD5 ad416d58aa5a4a822803554204a0085b
- SHA1 c9641fb957ba8f39512c9096a550ccf490d65303
- SHA512 0eb97b064dbf230a727f09c4f40e07f6ebff5c6a99e6fee81af571481f11af8bd907aba04e126c778cdb36c79dd8be8db847d0d5d9bece3f204e6ed4cfe7b7ca
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\QAssist.sys Stlmn.exe - Executes dropped EXE 6 IoCs
pid Process 3580 lsass.exe 3520 Stlmn.exe 2956 Stlmn.exe 4068 lsass.exe 936 Stlmn.exe 2704 Stlmn.exe - Sets service image path in registry 2 TTPs
-
resource yara_rule behavioral2/memory/3580-6-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/3520-9-0x0000000010000000-0x00000000101BA000-memory.dmp upx - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: Stlmn.exe File opened (read-only) \??\U: Stlmn.exe File opened (read-only) \??\Y: Stlmn.exe File opened (read-only) \??\G: Stlmn.exe File opened (read-only) \??\I: Stlmn.exe File opened (read-only) \??\J: Stlmn.exe File opened (read-only) \??\K: Stlmn.exe File opened (read-only) \??\O: Stlmn.exe File opened (read-only) \??\Z: Stlmn.exe File opened (read-only) \??\R: Stlmn.exe File opened (read-only) \??\W: Stlmn.exe File opened (read-only) \??\X: Stlmn.exe File opened (read-only) \??\B: Stlmn.exe File opened (read-only) \??\F: Stlmn.exe File opened (read-only) \??\Q: Stlmn.exe File opened (read-only) \??\V: Stlmn.exe File opened (read-only) \??\P: Stlmn.exe File opened (read-only) \??\T: Stlmn.exe File opened (read-only) \??\E: Stlmn.exe File opened (read-only) \??\H: Stlmn.exe File opened (read-only) \??\L: Stlmn.exe File opened (read-only) \??\M: Stlmn.exe File opened (read-only) \??\N: Stlmn.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Stlmn.exe lsass.exe File opened for modification C:\Windows\SysWOW64\Stlmn.exe lsass.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe rundll32.exe File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe rundll32.exe File opened for modification C:\Windows\lsass.exe lsass.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Stlmn.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Stlmn.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Stlmn.exe Key created \REGISTRY\USER\.DEFAULT\Software Stlmn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Stlmn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Stlmn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Stlmn.exe - Runs ping.exe 1 TTPs 2 IoCs
pid Process 2924 PING.EXE 1528 PING.EXE - Suspicious behavior: EnumeratesProcesses 198 IoCs
pid Process 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe 2956 Stlmn.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2956 Stlmn.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3580 lsass.exe Token: SeLoadDriverPrivilege 2956 Stlmn.exe Token: SeIncBasePriorityPrivilege 4068 lsass.exe Token: 33 2956 Stlmn.exe Token: SeIncBasePriorityPrivilege 2956 Stlmn.exe Token: 33 2956 Stlmn.exe Token: SeIncBasePriorityPrivilege 2956 Stlmn.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1584 rundll32.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 640 wrote to memory of 1584 640 rundll32.exe 71 PID 640 wrote to memory of 1584 640 rundll32.exe 71 PID 640 wrote to memory of 1584 640 rundll32.exe 71 PID 1584 wrote to memory of 3580 1584 rundll32.exe 76 PID 1584 wrote to memory of 3580 1584 rundll32.exe 76 PID 1584 wrote to memory of 3580 1584 rundll32.exe 76 PID 3580 wrote to memory of 3156 3580 lsass.exe 78 PID 3580 wrote to memory of 3156 3580 lsass.exe 78 PID 3580 wrote to memory of 3156 3580 lsass.exe 78 PID 3520 wrote to memory of 2956 3520 Stlmn.exe 79 PID 3520 wrote to memory of 2956 3520 Stlmn.exe 79 PID 3520 wrote to memory of 2956 3520 Stlmn.exe 79 PID 1584 wrote to memory of 4068 1584 rundll32.exe 81 PID 1584 wrote to memory of 4068 1584 rundll32.exe 81 PID 1584 wrote to memory of 4068 1584 rundll32.exe 81 PID 4068 wrote to memory of 1340 4068 lsass.exe 83 PID 4068 wrote to memory of 1340 4068 lsass.exe 83 PID 4068 wrote to memory of 1340 4068 lsass.exe 83 PID 936 wrote to memory of 2704 936 Stlmn.exe 84 PID 936 wrote to memory of 2704 936 Stlmn.exe 84 PID 936 wrote to memory of 2704 936 Stlmn.exe 84 PID 3156 wrote to memory of 2924 3156 cmd.exe 86 PID 3156 wrote to memory of 2924 3156 cmd.exe 86 PID 3156 wrote to memory of 2924 3156 cmd.exe 86 PID 1340 wrote to memory of 1528 1340 cmd.exe 87 PID 1340 wrote to memory of 1528 1340 cmd.exe 87 PID 1340 wrote to memory of 1528 1340 cmd.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad416d58aa5a4a822803554204a0085b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad416d58aa5a4a822803554204a0085b.dll,#12⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\lsass.exeC:\Windows\lsass.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Windows\lsass.exe > nul4⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- Runs ping.exe
PID:2924
-
-
-
-
C:\Windows\lsass.exeC:\Windows\lsass.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Windows\lsass.exe > nul4⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- Runs ping.exe
PID:1528
-
-
-
-
-
C:\Windows\SysWOW64\Stlmn.exeC:\Windows\SysWOW64\Stlmn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\Stlmn.exeC:\Windows\SysWOW64\Stlmn.exe -acsi2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Windows\SysWOW64\Stlmn.exeC:\Windows\SysWOW64\Stlmn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\Stlmn.exeC:\Windows\SysWOW64\Stlmn.exe -acsi2⤵
- Executes dropped EXE
PID:2704
-