Analysis
- max time kernel
129s - max time network
104s - platform
windows10_x64 - resource
win10v20201028 - submitted
19/01/2021, 17:15
Static task
static1
Behavioral task
behavioral1
Sample
9cca9e2442840635488611a1e84c1f5a.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9cca9e2442840635488611a1e84c1f5a.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 9cca9e2442840635488611a1e84c1f5a.exe
- Size 5.2MB
- Sample210119-snlavcsd3e
- SHA256 9165bc75e1a727c886b97c5dd3bdc42ed33d22f2895e8a830b94bd27fdeec2eb
- MD5 9cca9e2442840635488611a1e84c1f5a
- SHA1 0d1d23705124b72fd40617c141f5a02ad1ab8c54
- SHA512 8be15334c83c6fac1700fc79dd69fb13e33c0c842694ceccb5d1715c493838e01bc7551314738fc3a2c74ee953ffdd6596a53db5848b4f63d204b325992bbbc2
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2084 w1611076295.exe 4320 w1611076295.exe - Loads dropped DLL 56 IoCs
pid Process 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 5024 9cca9e2442840635488611a1e84c1f5a.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe 4320 w1611076295.exe - JavaScript code in executable 12 IoCs
resource yara_rule behavioral2/files/0x000100000001ab80-7.dat js behavioral2/files/0x000100000001ab80-8.dat js behavioral2/files/0x000100000001ab85-11.dat js behavioral2/files/0x000100000001ab7d-16.dat js behavioral2/files/0x000100000001ab7d-17.dat js behavioral2/files/0x000100000001abbd-40.dat js behavioral2/files/0x000100000001abbd-41.dat js behavioral2/files/0x000100000001abcf-44.dat js behavioral2/files/0x000100000001abb7-61.dat js behavioral2/files/0x000100000001abb7-62.dat js behavioral2/files/0x000100000001abbf-66.dat js behavioral2/files/0x000100000001abbf-65.dat js - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ipinfo.io - Detects Pyinstaller 3 IoCs
resource yara_rule behavioral2/files/0x000200000001a50e-36.dat pyinstaller behavioral2/files/0x000200000001a50e-37.dat pyinstaller behavioral2/files/0x000200000001a50e-39.dat pyinstaller - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 35 5024 9cca9e2442840635488611a1e84c1f5a.exe Token: 35 4320 w1611076295.exe Token: SeDebugPrivilege 4320 w1611076295.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4320 w1611076295.exe 4320 w1611076295.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4768 wrote to memory of 5024 4768 9cca9e2442840635488611a1e84c1f5a.exe 72 PID 4768 wrote to memory of 5024 4768 9cca9e2442840635488611a1e84c1f5a.exe 72 PID 4768 wrote to memory of 5024 4768 9cca9e2442840635488611a1e84c1f5a.exe 72 PID 5024 wrote to memory of 2084 5024 9cca9e2442840635488611a1e84c1f5a.exe 76 PID 5024 wrote to memory of 2084 5024 9cca9e2442840635488611a1e84c1f5a.exe 76 PID 5024 wrote to memory of 2084 5024 9cca9e2442840635488611a1e84c1f5a.exe 76 PID 2084 wrote to memory of 4320 2084 w1611076295.exe 77 PID 2084 wrote to memory of 4320 2084 w1611076295.exe 77 PID 2084 wrote to memory of 4320 2084 w1611076295.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cca9e2442840635488611a1e84c1f5a.exe"C:\Users\Admin\AppData\Local\Temp\9cca9e2442840635488611a1e84c1f5a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9cca9e2442840635488611a1e84c1f5a.exe"C:\Users\Admin\AppData\Local\Temp\9cca9e2442840635488611a1e84c1f5a.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\w1611076295.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\w1611076295.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\w1611076295.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\w1611076295.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4320
-
-
-