d514d46f084935189cef0a9be264edf003ab8b7acb0bb34bae3d69ac15adf2cc

Analysis

max time kernel
144s
max time network
143s
platform
windows7_x64
resource
win7v20201028
submitted
31/12/2020, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48d3a6f6395f252fae44cd8a13f6008a.exe
Size 407KB
Sample201231-sltvd68mms
SHA256 d514d46f084935189cef0a9be264edf003ab8b7acb0bb34bae3d69ac15adf2cc
MD5 48d3a6f6395f252fae44cd8a13f6008a
SHA1 648f3071c61a860e0e6835faf119fd08e49c9732
SHA512 5b73423f1339d3792edb274ad8175a48bb97db776759631e0d5ca00acc277d32d88d1df0cc76dab8f6b60a861f99e8b10466f3516f94fb74db931cc726b19da4
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
12	1508	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
1948	nethelper.exe

Loads dropped DLL 4 IoCs

pid	Process
1508	rundll32.exe
1508	rundll32.exe
1508	rundll32.exe
1508	rundll32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1912	schtasks.exe
1988	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1616	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1508	rundll32.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 316	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	29
PID 1932 wrote to memory of 316	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	29
PID 1932 wrote to memory of 316	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	29
PID 1932 wrote to memory of 316	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	29
PID 1932 wrote to memory of 1752	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	31
PID 1932 wrote to memory of 1752	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	31
PID 1932 wrote to memory of 1752	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	31
PID 1932 wrote to memory of 1752	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	31
PID 316 wrote to memory of 1088	316	cmd.exe	33
PID 316 wrote to memory of 1088	316	cmd.exe	33
PID 316 wrote to memory of 1088	316	cmd.exe	33
PID 316 wrote to memory of 1088	316	cmd.exe	33
PID 1752 wrote to memory of 1616	1752	cmd.exe	34
PID 1752 wrote to memory of 1616	1752	cmd.exe	34
PID 1752 wrote to memory of 1616	1752	cmd.exe	34
PID 1752 wrote to memory of 1616	1752	cmd.exe	34
PID 1932 wrote to memory of 1348	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	37
PID 1932 wrote to memory of 1348	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	37
PID 1932 wrote to memory of 1348	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	37
PID 1932 wrote to memory of 1348	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	37
PID 1932 wrote to memory of 1064	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	39
PID 1932 wrote to memory of 1064	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	39
PID 1932 wrote to memory of 1064	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	39
PID 1932 wrote to memory of 1064	1932	48d3a6f6395f252fae44cd8a13f6008a.exe	39
PID 1348 wrote to memory of 528	1348	cmd.exe	40
PID 1348 wrote to memory of 528	1348	cmd.exe	40
PID 1348 wrote to memory of 528	1348	cmd.exe	40
PID 1348 wrote to memory of 528	1348	cmd.exe	40
PID 1064 wrote to memory of 1508	1064	cmd.exe	42
PID 1064 wrote to memory of 1508	1064	cmd.exe	42
PID 1064 wrote to memory of 1508	1064	cmd.exe	42
PID 1064 wrote to memory of 1508	1064	cmd.exe	42
PID 1064 wrote to memory of 1508	1064	cmd.exe	42
PID 1064 wrote to memory of 1508	1064	cmd.exe	42
PID 1064 wrote to memory of 1508	1064	cmd.exe	42
PID 1752 wrote to memory of 1912	1752	cmd.exe	43
PID 1752 wrote to memory of 1912	1752	cmd.exe	43
PID 1752 wrote to memory of 1912	1752	cmd.exe	43
PID 1752 wrote to memory of 1912	1752	cmd.exe	43
PID 1508 wrote to memory of 316	1508	rundll32.exe	44
PID 1508 wrote to memory of 316	1508	rundll32.exe	44
PID 1508 wrote to memory of 316	1508	rundll32.exe	44
PID 1508 wrote to memory of 316	1508	rundll32.exe	44
PID 316 wrote to memory of 1988	316	cmd.exe	46
PID 316 wrote to memory of 1988	316	cmd.exe	46
PID 316 wrote to memory of 1988	316	cmd.exe	46
PID 316 wrote to memory of 1988	316	cmd.exe	46
PID 528 wrote to memory of 1948	528	taskeng.exe	49
PID 528 wrote to memory of 1948	528	taskeng.exe	49
PID 528 wrote to memory of 1948	528	taskeng.exe	49
PID 528 wrote to memory of 1948	528	taskeng.exe	49

C:\Users\Admin\AppData\Local\Temp\48d3a6f6395f252fae44cd8a13f6008a.exe
"C:\Users\Admin\AppData\Local\Temp\48d3a6f6395f252fae44cd8a13f6008a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\FkrJfZcbiSLMVChRtWga /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\NetHelper" /v path /t REG_SZ /d C:\ProgramData\NetHelper\Cache\FkrJfZcbiSLMVChRtWga /f
    3⤵
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout /t 60 && SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\FkrJfZcbiSLMVChRtWga\Ùnethelper.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 60
    3⤵
    - Delays execution with timeout.exe
    PID:1616
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\ProgramData\NetHelper\Cache\FkrJfZcbiSLMVChRtWga\Ùnethelper.exe /F
    3⤵
    - Creates scheduled task(s)
    PID:1912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\NetHelper" /v library /t REG_SZ /d C:\ProgramData\NetHelper\Cache\FkrJfZcbiSLMVChRtWga\nethelper.dll /f && EXIT 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\NetHelper" /v library /t REG_SZ /d C:\ProgramData\NetHelper\Cache\FkrJfZcbiSLMVChRtWga\nethelper.dll /f
    3⤵
    PID:528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C rundll32.exe C:\ProgramData\NetHelper\Cache\FkrJfZcbiSLMVChRtWga\nethelper.dll, UserModeExport
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\ProgramData\NetHelper\Cache\FkrJfZcbiSLMVChRtWga\nethelper.dll, UserModeExport
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\System32\cmd.exe /C SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\Users\Admin\AppData\Local\Temp\nethelper.exe /F
      4⤵
      Suspicious use of WriteProcessMemory
      PID:316
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /SC MINUTE /MO 1 /TN "Service for windows Network Helper updates" /TR C:\Users\Admin\AppData\Local\Temp\nethelper.exe /F
        5⤵
        Creates scheduled task(s)
        
        PID:1988

C:\Windows\system32\taskeng.exe
taskeng.exe {027B00E5-54D6-44C1-9BEF-40902AB20234} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\nethelper.exe
  C:\Users\Admin\AppData\Local\Temp\nethelper.exe
  2⤵
  - Executes dropped EXE
  PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-7-0x000007FEF6E90000-0x000007FEF710A000-memory.dmp

Download

memory/1932-2-0x0000000004A00000-0x0000000004A11000-memory.dmp

Download