Analysis
- max time kernel
149s - max time network
148s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/01/2021, 13:48
Static task
static1
Behavioral task
behavioral1
Sample
other.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
other.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target other.exe
- Size 927KB
- Sample210110-dxa1xbfb42
- SHA256 2cad1d5cd3e145f720e3da8825183d78545b834fe146a8d1ec26c0e876980a66
- MD5 c0fc0187c148b182981ad72e90e93b26
- SHA1 7c6b558731fec3a5ae6ff5de413988d4ba2631cd
- SHA512 ce43c86bc901c4c24d4a35dadda9f5953ae8da3d8693d46777fb50c20edd1259df85833189ff4606afe339bafc8d6f7fd284ea27e5a8cd35a063bb7ce6e6d597
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1356 rundll32.com - Loads dropped DLL 1 IoCs
pid Process 1756 cmd.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1356 set thread context of 1056 1356 rundll32.com 39 - Runs ping.exe 1 TTPs 2 IoCs
pid Process 1792 PING.EXE 696 PING.EXE - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1680 wrote to memory of 1988 1680 other.exe 26 PID 1680 wrote to memory of 1988 1680 other.exe 26 PID 1680 wrote to memory of 1988 1680 other.exe 26 PID 1680 wrote to memory of 1988 1680 other.exe 26 PID 1680 wrote to memory of 1208 1680 other.exe 28 PID 1680 wrote to memory of 1208 1680 other.exe 28 PID 1680 wrote to memory of 1208 1680 other.exe 28 PID 1680 wrote to memory of 1208 1680 other.exe 28 PID 1208 wrote to memory of 1756 1208 cmd.exe 30 PID 1208 wrote to memory of 1756 1208 cmd.exe 30 PID 1208 wrote to memory of 1756 1208 cmd.exe 30 PID 1208 wrote to memory of 1756 1208 cmd.exe 30 PID 1756 wrote to memory of 1792 1756 cmd.exe 31 PID 1756 wrote to memory of 1792 1756 cmd.exe 31 PID 1756 wrote to memory of 1792 1756 cmd.exe 31 PID 1756 wrote to memory of 1792 1756 cmd.exe 31 PID 1756 wrote to memory of 368 1756 cmd.exe 35 PID 1756 wrote to memory of 368 1756 cmd.exe 35 PID 1756 wrote to memory of 368 1756 cmd.exe 35 PID 1756 wrote to memory of 368 1756 cmd.exe 35 PID 1756 wrote to memory of 572 1756 cmd.exe 36 PID 1756 wrote to memory of 572 1756 cmd.exe 36 PID 1756 wrote to memory of 572 1756 cmd.exe 36 PID 1756 wrote to memory of 572 1756 cmd.exe 36 PID 1756 wrote to memory of 1356 1756 cmd.exe 37 PID 1756 wrote to memory of 1356 1756 cmd.exe 37 PID 1756 wrote to memory of 1356 1756 cmd.exe 37 PID 1756 wrote to memory of 1356 1756 cmd.exe 37 PID 1756 wrote to memory of 696 1756 cmd.exe 38 PID 1756 wrote to memory of 696 1756 cmd.exe 38 PID 1756 wrote to memory of 696 1756 cmd.exe 38 PID 1756 wrote to memory of 696 1756 cmd.exe 38 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39 PID 1356 wrote to memory of 1056 1356 rundll32.com 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\other.exe"C:\Users\Admin\AppData\Local\Temp\other.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo elyfkjbkl2⤵PID:1988
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < rbgakiwge.com2⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.execmd3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\PING.EXEping -n 1 gduzuextm4⤵
- Runs ping.exe
PID:1792
-
-
C:\Windows\SysWOW64\certutil.execertutil -decode vweyokbgl.com rundll32.com4⤵PID:368
-
-
C:\Windows\SysWOW64\certutil.execertutil -decode fzhgstpmz.com Q4⤵PID:572
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\rundll32.comrundll32.com Q4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"5⤵PID:1056
-
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 gduzuextm4⤵
- Runs ping.exe
PID:696
-
-
-