Overview
overview
10Static
static
100caa6fb680...c6.exe
windows7_x64
100caa6fb680...c6.exe
windows10_x64
10165ec181ff...71.exe
windows7_x64
9165ec181ff...71.exe
windows10_x64
919f1fcac5e...22.exe
windows7_x64
119f1fcac5e...22.exe
windows10_x64
11a3642fa7d...de.exe
windows7_x64
91a3642fa7d...de.exe
windows10_x64
91d6d8960e8...5d.exe
windows7_x64
91d6d8960e8...5d.exe
windows10_x64
9213f46a611...fc.exe
windows7_x64
9213f46a611...fc.exe
windows10_x64
9284c9bd06a...47.exe
windows7_x64
9284c9bd06a...47.exe
windows10_x64
92b08cbe646...d4.exe
windows7_x64
92b08cbe646...d4.exe
windows10_x64
92c44be7232...76.exe
windows7_x64
62c44be7232...76.exe
windows10_x64
62e1deb95bf...f0.exe
windows7_x64
92e1deb95bf...f0.exe
windows10_x64
92f7a2890d3...2b.exe
windows7_x64
82f7a2890d3...2b.exe
windows10_x64
836fc7610e5...6f.exe
windows7_x64
936fc7610e5...6f.exe
windows10_x64
93842928b05...6a.exe
windows7_x64
83842928b05...6a.exe
windows10_x64
83af2caadbf...ae.exe
windows7_x64
93af2caadbf...ae.exe
windows10_x64
9416baeb19a...40.exe
windows7_x64
7416baeb19a...40.exe
windows10_x64
7448a675cb7...2c.exe
windows7_x64
8448a675cb7...2c.exe
windows10_x64
8Resubmissions
17-01-2021 19:18
210117-5hwxlye88x 1017-01-2021 17:05
210117-6jkt8jz44e 1017-01-2021 10:25
210117-ncy8vksfgn 10Analysis
-
max time kernel
157s -
max time network
169s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-01-2021 10:25
Behavioral task
behavioral1
Sample
0caa6fb680e981e7d3353f19f830903c9e6438ecb14ddaa237ce747619d7d4c6.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
0caa6fb680e981e7d3353f19f830903c9e6438ecb14ddaa237ce747619d7d4c6.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
165ec181ff15e423abd3aa500bea857faf12fa34b4d53618028bd7a69af2eb71.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral4
Sample
165ec181ff15e423abd3aa500bea857faf12fa34b4d53618028bd7a69af2eb71.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
19f1fcac5e8dbd1d8ff78a295a3a16b533defb40a414dd360a6f75ca5101ac22.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral6
Sample
19f1fcac5e8dbd1d8ff78a295a3a16b533defb40a414dd360a6f75ca5101ac22.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral8
Sample
1a3642fa7da48a4950a11c6346c5fa1b3a61eff52c076603b1c4d005406cfede.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
1d6d8960e8999bed25a88c4b9c8ad5f92f5314f2b50a012bcc7a6873ddcba25d.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral10
Sample
1d6d8960e8999bed25a88c4b9c8ad5f92f5314f2b50a012bcc7a6873ddcba25d.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
213f46a61158000136d67452f6c638949db7a60674ed2af8379f6bbe7acb49fc.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral12
Sample
213f46a61158000136d67452f6c638949db7a60674ed2af8379f6bbe7acb49fc.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
284c9bd06ae67203244ed420c798188c7d0846938b21ba970ce64318452d6947.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral14
Sample
284c9bd06ae67203244ed420c798188c7d0846938b21ba970ce64318452d6947.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
2b08cbe646e4941556c400c8a9f4f2a073514d0ef919a88612696907f560aed4.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral16
Sample
2b08cbe646e4941556c400c8a9f4f2a073514d0ef919a88612696907f560aed4.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
2c44be72321c29c1c20f09fb5c78ed59b76a74926f5581a77b13c6fafb502076.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral18
Sample
2c44be72321c29c1c20f09fb5c78ed59b76a74926f5581a77b13c6fafb502076.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
2e1deb95bfe713cf40cbb21b3821a83bb1d3cdda412ce78456e3e31741034cf0.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral20
Sample
2e1deb95bfe713cf40cbb21b3821a83bb1d3cdda412ce78456e3e31741034cf0.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral22
Sample
2f7a2890d38eeb574b1c357854c137c1403dfc0db6410a8e0186339da862c52b.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
36fc7610e543a7bc9bee637ddb0c03263dd1b6964774cfbced9f649a01def36f.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral24
Sample
36fc7610e543a7bc9bee637ddb0c03263dd1b6964774cfbced9f649a01def36f.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral26
Sample
3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
3af2caadbf55cfcf7c91403368d2aee7db836203a27bf2ad48895d6d696c68ae.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral28
Sample
3af2caadbf55cfcf7c91403368d2aee7db836203a27bf2ad48895d6d696c68ae.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral30
Sample
416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
448a675cb76d76830930fd79347452b44bfc13eca1fc92c4e81d00eedfafac2c.exe
Resource
win7v20201028
windows7_x64
General
-
Target
416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe
-
Size
56.1MB
-
MD5
2f916f4272d4426fd629810a57a54fb3
-
SHA1
a4ac414101162bb062ee03d8364d57248e8f1a39
-
SHA256
416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40
-
SHA512
f2e4434cb5f9c48187d712fb3f77cca3f0d5acbe985b5f65db54be4ea0ead4942f85e02252455ffb9e82e396c87711ee2af81c6d94d58a966dc246d9233db069
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 652 mspaint.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Explorer Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Update\\Explorer.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run mspaint.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xoyfyc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Xoyfyc.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\D: mspaint.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1104 set thread context of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\bett2f002 svchost.exe File opened for modification C:\Program Files\Common Files\CreativeAudio svchost.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 816 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2008 svchost.exe 2008 svchost.exe 2008 svchost.exe 2008 svchost.exe 2008 svchost.exe 1400 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 1400 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1400 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe Token: SeDebugPrivilege 2008 svchost.exe Token: SeDebugPrivilege 2032 calc.exe Token: SeDebugPrivilege 652 mspaint.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 1104 wrote to memory of 2008 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 27 PID 1104 wrote to memory of 2008 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 27 PID 1104 wrote to memory of 2008 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 27 PID 1104 wrote to memory of 2008 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 27 PID 1104 wrote to memory of 2008 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 27 PID 1104 wrote to memory of 2032 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 26 PID 1104 wrote to memory of 2032 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 26 PID 1104 wrote to memory of 2032 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 26 PID 1104 wrote to memory of 2032 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 26 PID 1104 wrote to memory of 2032 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 26 PID 1104 wrote to memory of 2032 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 26 PID 1104 wrote to memory of 2008 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 27 PID 2008 wrote to memory of 1788 2008 svchost.exe 28 PID 2008 wrote to memory of 1788 2008 svchost.exe 28 PID 2008 wrote to memory of 1788 2008 svchost.exe 28 PID 2008 wrote to memory of 1788 2008 svchost.exe 28 PID 2008 wrote to memory of 1756 2008 svchost.exe 30 PID 2008 wrote to memory of 1756 2008 svchost.exe 30 PID 2008 wrote to memory of 1756 2008 svchost.exe 30 PID 2008 wrote to memory of 1756 2008 svchost.exe 30 PID 2008 wrote to memory of 896 2008 svchost.exe 32 PID 2008 wrote to memory of 896 2008 svchost.exe 32 PID 2008 wrote to memory of 896 2008 svchost.exe 32 PID 2008 wrote to memory of 896 2008 svchost.exe 32 PID 2008 wrote to memory of 1452 2008 svchost.exe 34 PID 2008 wrote to memory of 1452 2008 svchost.exe 34 PID 2008 wrote to memory of 1452 2008 svchost.exe 34 PID 2008 wrote to memory of 1452 2008 svchost.exe 34 PID 2008 wrote to memory of 1072 2008 svchost.exe 37 PID 2008 wrote to memory of 1072 2008 svchost.exe 37 PID 2008 wrote to memory of 1072 2008 svchost.exe 37 PID 2008 wrote to memory of 1072 2008 svchost.exe 37 PID 2008 wrote to memory of 816 2008 svchost.exe 41 PID 2008 wrote to memory of 816 2008 svchost.exe 41 PID 2008 wrote to memory of 816 2008 svchost.exe 41 PID 2008 wrote to memory of 816 2008 svchost.exe 41 PID 2008 wrote to memory of 652 2008 svchost.exe 43 PID 2008 wrote to memory of 652 2008 svchost.exe 43 PID 2008 wrote to memory of 652 2008 svchost.exe 43 PID 2008 wrote to memory of 652 2008 svchost.exe 43 PID 2008 wrote to memory of 652 2008 svchost.exe 43 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1104 wrote to memory of 1400 1104 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 44 PID 1400 wrote to memory of 2008 1400 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 27 PID 1400 wrote to memory of 2008 1400 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 27 PID 1400 wrote to memory of 2032 1400 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 26 PID 1400 wrote to memory of 2032 1400 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 26 PID 1400 wrote to memory of 652 1400 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 43 PID 1400 wrote to memory of 652 1400 416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe"C:\Users\Admin\AppData\Local\Temp\416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Windows Update Check - 0x05860166" /f3⤵PID:1788
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Windows Update Check - 0x0E7302EC" /f3⤵PID:1756
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Windows Update Check - 0x5C000766" /f3⤵PID:896
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn "Windows Update Check - 0x6E0A0825" /f3⤵PID:1452
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Debugger"3⤵PID:1072
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Debugger" /TR "C:\Users\Admin\AppData\Roaming\update\Explorer.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:816
-
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"3⤵
- Deletes itself
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:652
-
-
-
C:\Users\Admin\AppData\Local\Temp\416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe"C:\Users\Admin\AppData\Local\Temp\416baeb19adb37e66000e685e04d70586b022f5d36ae411080f89e5590bb8f40.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
-