277b00b90fba4bbe1ecdaf3a2c9b9784d66a8ec6948b730ed7d608e9c69331bb

Analysis

max time kernel
148s
max time network
145s
platform
windows7_x64
resource
win7v20201028
submitted
30/12/2020, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f3ffa9f0bda5118d6638441b86900ad.exe
Size 423KB
Sample201230-762gefwc3a
SHA256 277b00b90fba4bbe1ecdaf3a2c9b9784d66a8ec6948b730ed7d608e9c69331bb
MD5 7f3ffa9f0bda5118d6638441b86900ad
SHA1 01ef0ba10a169096817705d3f515a9bad9fbb118
SHA512 6b8cb836ec9b19e931613b0d5f55d8c79d463e9ce24d8758cb23016c0e091d2c1b5f146ce5e19245827bd8661b5fa1b1fea088270f610b3f0016abffb9f88b62
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	1080	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
1572	nethelper.exe

Loads dropped DLL 4 IoCs

pid	Process
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1604	schtasks.exe
1988	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
520	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1080	rundll32.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 896	476	7f3ffa9f0bda5118d6638441b86900ad.exe	29
PID 476 wrote to memory of 896	476	7f3ffa9f0bda5118d6638441b86900ad.exe	29
PID 476 wrote to memory of 896	476	7f3ffa9f0bda5118d6638441b86900ad.exe	29
PID 476 wrote to memory of 896	476	7f3ffa9f0bda5118d6638441b86900ad.exe	29
PID 476 wrote to memory of 1380	476	7f3ffa9f0bda5118d6638441b86900ad.exe	31
PID 476 wrote to memory of 1380	476	7f3ffa9f0bda5118d6638441b86900ad.exe	31
PID 476 wrote to memory of 1380	476	7f3ffa9f0bda5118d6638441b86900ad.exe	31
PID 476 wrote to memory of 1380	476	7f3ffa9f0bda5118d6638441b86900ad.exe	31
PID 896 wrote to memory of 392	896	cmd.exe	33
PID 896 wrote to memory of 392	896	cmd.exe	33
PID 896 wrote to memory of 392	896	cmd.exe	33
PID 896 wrote to memory of 392	896	cmd.exe	33
PID 1380 wrote to memory of 520	1380	cmd.exe	34
PID 1380 wrote to memory of 520	1380	cmd.exe	34
PID 1380 wrote to memory of 520	1380	cmd.exe	34
PID 1380 wrote to memory of 520	1380	cmd.exe	34
PID 476 wrote to memory of 1676	476	7f3ffa9f0bda5118d6638441b86900ad.exe	37
PID 476 wrote to memory of 1676	476	7f3ffa9f0bda5118d6638441b86900ad.exe	37
PID 476 wrote to memory of 1676	476	7f3ffa9f0bda5118d6638441b86900ad.exe	37
PID 476 wrote to memory of 1676	476	7f3ffa9f0bda5118d6638441b86900ad.exe	37
PID 476 wrote to memory of 1544	476	7f3ffa9f0bda5118d6638441b86900ad.exe	39
PID 476 wrote to memory of 1544	476	7f3ffa9f0bda5118d6638441b86900ad.exe	39
PID 476 wrote to memory of 1544	476	7f3ffa9f0bda5118d6638441b86900ad.exe	39
PID 476 wrote to memory of 1544	476	7f3ffa9f0bda5118d6638441b86900ad.exe	39
PID 1676 wrote to memory of 1452	1676	cmd.exe	41
PID 1676 wrote to memory of 1452	1676	cmd.exe	41
PID 1676 wrote to memory of 1452	1676	cmd.exe	41
PID 1676 wrote to memory of 1452	1676	cmd.exe	41
PID 1544 wrote to memory of 1080	1544	cmd.exe	42
PID 1544 wrote to memory of 1080	1544	cmd.exe	42
PID 1544 wrote to memory of 1080	1544	cmd.exe	42
PID 1544 wrote to memory of 1080	1544	cmd.exe	42
PID 1544 wrote to memory of 1080	1544	cmd.exe	42
PID 1544 wrote to memory of 1080	1544	cmd.exe	42
PID 1544 wrote to memory of 1080	1544	cmd.exe	42
PID 1380 wrote to memory of 1604	1380	cmd.exe	43
PID 1380 wrote to memory of 1604	1380	cmd.exe	43
PID 1380 wrote to memory of 1604	1380	cmd.exe	43
PID 1380 wrote to memory of 1604	1380	cmd.exe	43
PID 1080 wrote to memory of 2024	1080	rundll32.exe	44
PID 1080 wrote to memory of 2024	1080	rundll32.exe	44
PID 1080 wrote to memory of 2024	1080	rundll32.exe	44
PID 1080 wrote to memory of 2024	1080	rundll32.exe	44
PID 2024 wrote to memory of 1988	2024	cmd.exe	46
PID 2024 wrote to memory of 1988	2024	cmd.exe	46
PID 2024 wrote to memory of 1988	2024	cmd.exe	46
PID 2024 wrote to memory of 1988	2024	cmd.exe	46
PID 1120 wrote to memory of 1572	1120	taskeng.exe	49
PID 1120 wrote to memory of 1572	1120	taskeng.exe	49
PID 1120 wrote to memory of 1572	1120	taskeng.exe	49
PID 1120 wrote to memory of 1572	1120	taskeng.exe	49

C:\Users\Admin\AppData\Local\Temp\7f3ffa9f0bda5118d6638441b86900ad.exe
"C:\Users\Admin\AppData\Local\Temp\7f3ffa9f0bda5118d6638441b86900ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:476
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\GvKywLbjGlcWUsQfTKOH /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\GvKywLbjGlcWUsQfTKOH /f
    3⤵
    PID:392
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout /t 60 && SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\GvKywLbjGlcWUsQfTKOH\nethelper.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 60
    3⤵
    - Delays execution with timeout.exe
    PID:520
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\GvKywLbjGlcWUsQfTKOH\nethelper.exe /F
    3⤵
    - Creates scheduled task(s)
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\NetHelper" /v library /t REG_SZ /d C:\ProgramData\NetHelper\Cache\GvKywLbjGlcWUsQfTKOH\nethelper.dll /f && EXIT 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\NetHelper" /v library /t REG_SZ /d C:\ProgramData\NetHelper\Cache\GvKywLbjGlcWUsQfTKOH\nethelper.dll /f
    3⤵
    PID:1452
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C rundll32.exe C:\ProgramData\NetHelper\Cache\GvKywLbjGlcWUsQfTKOH\nethelper.dll, UserModeExport
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\ProgramData\NetHelper\Cache\GvKywLbjGlcWUsQfTKOH\nethelper.dll, UserModeExport
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\System32\cmd.exe /C SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\Users\Admin\AppData\Local\Temp\nethelper.exe /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\Users\Admin\AppData\Local\Temp\nethelper.exe /F
        5⤵
        Creates scheduled task(s)
        
        PID:1988

C:\Windows\system32\taskeng.exe
taskeng.exe {FE818437-6A0C-4B1B-ABFD-A1FF182E19AD} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\nethelper.exe
  C:\Users\Admin\AppData\Local\Temp\nethelper.exe
  2⤵
  - Executes dropped EXE
  PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/476-2-0x00000000049E0000-0x00000000049F1000-memory.dmp

Download

memory/808-7-0x000007FEF6200000-0x000007FEF647A000-memory.dmp

Download