Overview

overview

10

Static

static

comparendo...co.exe

windows7_x64

8

comparendo...co.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    20/04/2021, 18:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    comparendopicoycedula365215999runtcomco.exe
  • Size 2.3MB
  • Sample210420-nc34wpgble
  • SHA256 368e9e3d450bae08f20e5ab0937dcd47a03835daabe900ddf87c746fb99a50fb
  • MD5 SHA1 SHA512
Score
8/10
persistenceupx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\comparendopicoycedula365215999runtcomco.exe
    "C:\Users\Admin\AppData\Local\Temp\comparendopicoycedula365215999runtcomco.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Users\Admin\AppData\Local\Temp\comparendopicoycedula365215999runtcomco.exe
      "C:\Users\Admin\AppData\Local\Temp\comparendopicoycedula365215999runtcomco.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1324

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/756-59-0x00000000011C0000-0x00000000011C1000-memory.dmp
        Download

        memory/756-61-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
        Download

        memory/756-62-0x0000000000490000-0x0000000000499000-memory.dmp
        Download

        memory/756-63-0x0000000005B80000-0x0000000005D56000-memory.dmp
        Download

        memory/756-64-0x00000000058C0000-0x0000000005A49000-memory.dmp
        Download

        memory/1324-65-0x0000000000400000-0x00000000007E4000-memory.dmp
        Download

        memory/1324-67-0x00000000750C1000-0x00000000750C3000-memory.dmp
        Download

        memory/1324-68-0x0000000000400000-0x00000000007E4000-memory.dmp
        Download