Analysis
- max time kernel
150s - max time network
91s - platform
windows7_x64 - resource
win7v20201028 - submitted
19/01/2021, 17:15
Static task
static1
Behavioral task
behavioral1
Sample
9cca9e2442840635488611a1e84c1f5a.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9cca9e2442840635488611a1e84c1f5a.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 9cca9e2442840635488611a1e84c1f5a.exe
- Size 5.2MB
- Sample210119-snlavcsd3e
- SHA256 9165bc75e1a727c886b97c5dd3bdc42ed33d22f2895e8a830b94bd27fdeec2eb
- MD5 9cca9e2442840635488611a1e84c1f5a
- SHA1 0d1d23705124b72fd40617c141f5a02ad1ab8c54
- SHA512 8be15334c83c6fac1700fc79dd69fb13e33c0c842694ceccb5d1715c493838e01bc7551314738fc3a2c74ee953ffdd6596a53db5848b4f63d204b325992bbbc2
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 612 w1611080325.exe 1532 w1611080325.exe - Loads dropped DLL 57 IoCs
pid Process 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1416 9cca9e2442840635488611a1e84c1f5a.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe 1532 w1611080325.exe - JavaScript code in executable 12 IoCs
resource yara_rule behavioral1/files/0x00030000000130fb-3.dat js behavioral1/files/0x00030000000130fb-4.dat js behavioral1/files/0x0003000000013100-7.dat js behavioral1/files/0x00030000000130f8-12.dat js behavioral1/files/0x00030000000130f8-13.dat js behavioral1/files/0x0003000000013183-37.dat js behavioral1/files/0x0003000000013183-38.dat js behavioral1/files/0x0003000000013195-41.dat js behavioral1/files/0x000300000001317d-58.dat js behavioral1/files/0x000300000001317d-59.dat js behavioral1/files/0x0003000000013185-62.dat js behavioral1/files/0x0003000000013185-63.dat js - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ipinfo.io - Detects Pyinstaller 4 IoCs
resource yara_rule behavioral1/files/0x0003000000013106-31.dat pyinstaller behavioral1/files/0x0003000000013106-33.dat pyinstaller behavioral1/files/0x0003000000013106-34.dat pyinstaller behavioral1/files/0x0003000000013106-36.dat pyinstaller - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 35 1416 9cca9e2442840635488611a1e84c1f5a.exe Token: 35 1532 w1611080325.exe Token: SeDebugPrivilege 1532 w1611080325.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1532 w1611080325.exe 1532 w1611080325.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1864 wrote to memory of 1416 1864 9cca9e2442840635488611a1e84c1f5a.exe 26 PID 1864 wrote to memory of 1416 1864 9cca9e2442840635488611a1e84c1f5a.exe 26 PID 1864 wrote to memory of 1416 1864 9cca9e2442840635488611a1e84c1f5a.exe 26 PID 1864 wrote to memory of 1416 1864 9cca9e2442840635488611a1e84c1f5a.exe 26 PID 1416 wrote to memory of 612 1416 9cca9e2442840635488611a1e84c1f5a.exe 30 PID 1416 wrote to memory of 612 1416 9cca9e2442840635488611a1e84c1f5a.exe 30 PID 1416 wrote to memory of 612 1416 9cca9e2442840635488611a1e84c1f5a.exe 30 PID 1416 wrote to memory of 612 1416 9cca9e2442840635488611a1e84c1f5a.exe 30 PID 612 wrote to memory of 1532 612 w1611080325.exe 31 PID 612 wrote to memory of 1532 612 w1611080325.exe 31 PID 612 wrote to memory of 1532 612 w1611080325.exe 31 PID 612 wrote to memory of 1532 612 w1611080325.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cca9e2442840635488611a1e84c1f5a.exe"C:\Users\Admin\AppData\Local\Temp\9cca9e2442840635488611a1e84c1f5a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\9cca9e2442840635488611a1e84c1f5a.exe"C:\Users\Admin\AppData\Local\Temp\9cca9e2442840635488611a1e84c1f5a.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\w1611080325.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows Media\w1611080325.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\w1611080325.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows Media\w1611080325.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
-