Analysis
- max time kernel
151s - max time network
77s - platform
windows7_x64 - resource
win7v20201028 - submitted
03/03/2021, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
bot.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bot.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target bot.exe
- Size 138KB
- Sample210303-396rl3l7ja
- SHA256 4537ddae449e5d460e3c18f33fdbe2d72321700200426dec253f1c9813470a57
- MD5 5c8df4e2f2ea5b69f1c6b65f7b6f73c0
- SHA1 a2f79bd38e99e7cc2e03d6cf62ddbdb3707d6da6
- SHA512 58d45f0dc1c368b3801e4bfde54d5253d6e0b7bf172069708c5d01fc8f0c9e1df7abca63587689057a4e2c45e942962b6d022068a7cc79d289e1b828db687cff
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1284 ittal.exe - Deletes itself 1 IoCs
pid Process 384 cmd.exe - Loads dropped DLL 2 IoCs
pid Process 324 bot.exe 324 bot.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\Currentversion\Run ittal.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\{037349A9-39E6-F658-F078-5DD5F7650B8B} = "C:\\Users\\Admin\\AppData\\Roaming\\Sarifu\\ittal.exe" ittal.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 324 set thread context of 384 324 bot.exe 31 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Privacy bot.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" bot.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\482707AB-00000001.eml:OECustomProperty WinMail.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe 1284 ittal.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeSecurityPrivilege 324 bot.exe Token: SeSecurityPrivilege 324 bot.exe Token: SeSecurityPrivilege 324 bot.exe Token: SeManageVolumePrivilege 520 WinMail.exe Token: SeSecurityPrivilege 384 cmd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 520 WinMail.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 324 wrote to memory of 1284 324 bot.exe 29 PID 324 wrote to memory of 1284 324 bot.exe 29 PID 324 wrote to memory of 1284 324 bot.exe 29 PID 324 wrote to memory of 1284 324 bot.exe 29 PID 1284 wrote to memory of 1096 1284 ittal.exe 7 PID 1284 wrote to memory of 1096 1284 ittal.exe 7 PID 1284 wrote to memory of 1096 1284 ittal.exe 7 PID 1284 wrote to memory of 1096 1284 ittal.exe 7 PID 1284 wrote to memory of 1096 1284 ittal.exe 7 PID 1284 wrote to memory of 1168 1284 ittal.exe 6 PID 1284 wrote to memory of 1168 1284 ittal.exe 6 PID 1284 wrote to memory of 1168 1284 ittal.exe 6 PID 1284 wrote to memory of 1168 1284 ittal.exe 6 PID 1284 wrote to memory of 1168 1284 ittal.exe 6 PID 1284 wrote to memory of 1196 1284 ittal.exe 5 PID 1284 wrote to memory of 1196 1284 ittal.exe 5 PID 1284 wrote to memory of 1196 1284 ittal.exe 5 PID 1284 wrote to memory of 1196 1284 ittal.exe 5 PID 1284 wrote to memory of 1196 1284 ittal.exe 5 PID 1284 wrote to memory of 324 1284 ittal.exe 24 PID 1284 wrote to memory of 324 1284 ittal.exe 24 PID 1284 wrote to memory of 324 1284 ittal.exe 24 PID 1284 wrote to memory of 324 1284 ittal.exe 24 PID 1284 wrote to memory of 324 1284 ittal.exe 24 PID 1284 wrote to memory of 520 1284 ittal.exe 30 PID 1284 wrote to memory of 520 1284 ittal.exe 30 PID 1284 wrote to memory of 520 1284 ittal.exe 30 PID 1284 wrote to memory of 520 1284 ittal.exe 30 PID 1284 wrote to memory of 520 1284 ittal.exe 30 PID 324 wrote to memory of 384 324 bot.exe 31 PID 324 wrote to memory of 384 324 bot.exe 31 PID 324 wrote to memory of 384 324 bot.exe 31 PID 324 wrote to memory of 384 324 bot.exe 31 PID 324 wrote to memory of 384 324 bot.exe 31 PID 324 wrote to memory of 384 324 bot.exe 31 PID 324 wrote to memory of 384 324 bot.exe 31 PID 324 wrote to memory of 384 324 bot.exe 31 PID 324 wrote to memory of 384 324 bot.exe 31 PID 1284 wrote to memory of 1644 1284 ittal.exe 33 PID 1284 wrote to memory of 1644 1284 ittal.exe 33 PID 1284 wrote to memory of 1644 1284 ittal.exe 33 PID 1284 wrote to memory of 1644 1284 ittal.exe 33 PID 1284 wrote to memory of 1644 1284 ittal.exe 33 PID 1284 wrote to memory of 1776 1284 ittal.exe 34 PID 1284 wrote to memory of 1776 1284 ittal.exe 34 PID 1284 wrote to memory of 1776 1284 ittal.exe 34 PID 1284 wrote to memory of 1776 1284 ittal.exe 34 PID 1284 wrote to memory of 1776 1284 ittal.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\bot.exe"C:\Users\Admin\AppData\Local\Temp\bot.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Roaming\Sarifu\ittal.exe"C:\Users\Admin\AppData\Roaming\Sarifu\ittal.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpde9d9cf7.bat"3⤵
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
PID:384
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:520
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1644
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1776