277b00b90fba4bbe1ecdaf3a2c9b9784d66a8ec6948b730ed7d608e9c69331bb

Analysis

max time kernel
141s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
30/12/2020, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f3ffa9f0bda5118d6638441b86900ad.exe
Size 423KB
Sample201230-762gefwc3a
SHA256 277b00b90fba4bbe1ecdaf3a2c9b9784d66a8ec6948b730ed7d608e9c69331bb
MD5 7f3ffa9f0bda5118d6638441b86900ad
SHA1 01ef0ba10a169096817705d3f515a9bad9fbb118
SHA512 6b8cb836ec9b19e931613b0d5f55d8c79d463e9ce24d8758cb23016c0e091d2c1b5f146ce5e19245827bd8661b5fa1b1fea088270f610b3f0016abffb9f88b62
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3844	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2640	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4088	timeout.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3244	644	7f3ffa9f0bda5118d6638441b86900ad.exe	78
PID 644 wrote to memory of 3244	644	7f3ffa9f0bda5118d6638441b86900ad.exe	78
PID 644 wrote to memory of 3244	644	7f3ffa9f0bda5118d6638441b86900ad.exe	78
PID 644 wrote to memory of 1452	644	7f3ffa9f0bda5118d6638441b86900ad.exe	79
PID 644 wrote to memory of 1452	644	7f3ffa9f0bda5118d6638441b86900ad.exe	79
PID 644 wrote to memory of 1452	644	7f3ffa9f0bda5118d6638441b86900ad.exe	79
PID 3244 wrote to memory of 1308	3244	cmd.exe	82
PID 3244 wrote to memory of 1308	3244	cmd.exe	82
PID 3244 wrote to memory of 1308	3244	cmd.exe	82
PID 1452 wrote to memory of 4088	1452	cmd.exe	83
PID 1452 wrote to memory of 4088	1452	cmd.exe	83
PID 1452 wrote to memory of 4088	1452	cmd.exe	83
PID 644 wrote to memory of 2240	644	7f3ffa9f0bda5118d6638441b86900ad.exe	84
PID 644 wrote to memory of 2240	644	7f3ffa9f0bda5118d6638441b86900ad.exe	84
PID 644 wrote to memory of 2240	644	7f3ffa9f0bda5118d6638441b86900ad.exe	84
PID 644 wrote to memory of 1148	644	7f3ffa9f0bda5118d6638441b86900ad.exe	86
PID 644 wrote to memory of 1148	644	7f3ffa9f0bda5118d6638441b86900ad.exe	86
PID 644 wrote to memory of 1148	644	7f3ffa9f0bda5118d6638441b86900ad.exe	86
PID 2240 wrote to memory of 2820	2240	cmd.exe	88
PID 2240 wrote to memory of 2820	2240	cmd.exe	88
PID 2240 wrote to memory of 2820	2240	cmd.exe	88
PID 1148 wrote to memory of 3844	1148	cmd.exe	89
PID 1148 wrote to memory of 3844	1148	cmd.exe	89
PID 1148 wrote to memory of 3844	1148	cmd.exe	89
PID 1452 wrote to memory of 2640	1452	cmd.exe	90
PID 1452 wrote to memory of 2640	1452	cmd.exe	90
PID 1452 wrote to memory of 2640	1452	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\7f3ffa9f0bda5118d6638441b86900ad.exe
"C:\Users\Admin\AppData\Local\Temp\7f3ffa9f0bda5118d6638441b86900ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\WvOQKdbigcaKKowlDpho /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\WvOQKdbigcaKKowlDpho /f
    3⤵
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout /t 60 && SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\WvOQKdbigcaKKowlDpho\nethelper.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 60
    3⤵
    - Delays execution with timeout.exe
    PID:4088
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\WvOQKdbigcaKKowlDpho\nethelper.exe /F
    3⤵
    - Creates scheduled task(s)
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\NetHelper" /v library /t REG_SZ /d C:\ProgramData\NetHelper\Cache\WvOQKdbigcaKKowlDpho\nethelper.dll /f && EXIT 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\NetHelper" /v library /t REG_SZ /d C:\ProgramData\NetHelper\Cache\WvOQKdbigcaKKowlDpho\nethelper.dll /f
    3⤵
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C rundll32.exe C:\ProgramData\NetHelper\Cache\WvOQKdbigcaKKowlDpho\nethelper.dll, UserModeExport
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\ProgramData\NetHelper\Cache\WvOQKdbigcaKKowlDpho\nethelper.dll, UserModeExport
    3⤵
    - Loads dropped DLL
    PID:3844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-2-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads