Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-05-2021 13:00
Static task
static1
Behavioral task
behavioral1
Sample
taskhost.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
taskhost.exe
Resource
win10v20210410
General
-
Target
taskhost.exe
-
Size
2.8MB
-
MD5
4d07687083cbaa9c4f9ed49ce324a74b
-
SHA1
b56252678f52db028b3731de9940bffe4d666fcc
-
SHA256
fd262d6c99b548dc34af6c75ec941894432781cbd760e8213be95ce65f1a7bba
-
SHA512
07962b7d646a6e2d8c570da102a1bbd960c81df22c5681b39c49b307a9cf2a4dfea8e607f5be40c43a5828ba15d1c4ada76ebc95d0f6d540e2d0b86a32d41ba7
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1524-119-0x0000000000400000-0x0000000000A16000-memory.dmp upx behavioral2/memory/1524-120-0x0000000000400000-0x0000000000A16000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UkeplxjeiD.url wscript.exe -
Suspicious use of SetThreadContext 17 IoCs
Processes:
taskhost.exetaskhost.exedescription pid process target process PID 1892 set thread context of 3280 1892 taskhost.exe taskhost.exe PID 3280 set thread context of 1524 3280 taskhost.exe notepad.exe PID 3280 set thread context of 3176 3280 taskhost.exe notepad.exe PID 3280 set thread context of 3856 3280 taskhost.exe notepad.exe PID 3280 set thread context of 1808 3280 taskhost.exe notepad.exe PID 3280 set thread context of 1456 3280 taskhost.exe notepad.exe PID 3280 set thread context of 3968 3280 taskhost.exe notepad.exe PID 3280 set thread context of 1860 3280 taskhost.exe notepad.exe PID 3280 set thread context of 4088 3280 taskhost.exe notepad.exe PID 3280 set thread context of 3864 3280 taskhost.exe notepad.exe PID 3280 set thread context of 3856 3280 taskhost.exe notepad.exe PID 3280 set thread context of 2204 3280 taskhost.exe notepad.exe PID 3280 set thread context of 1160 3280 taskhost.exe notepad.exe PID 3280 set thread context of 984 3280 taskhost.exe notepad.exe PID 3280 set thread context of 3992 3280 taskhost.exe notepad.exe PID 3280 set thread context of 700 3280 taskhost.exe notepad.exe PID 3280 set thread context of 2164 3280 taskhost.exe notepad.exe -
Program crash 16 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2356 1524 WerFault.exe notepad.exe 3928 3176 WerFault.exe notepad.exe 684 3856 WerFault.exe notepad.exe 2812 1808 WerFault.exe notepad.exe 3792 1456 WerFault.exe notepad.exe 2148 3968 WerFault.exe notepad.exe 8 1860 WerFault.exe notepad.exe 3952 4088 WerFault.exe notepad.exe 664 3864 WerFault.exe notepad.exe 2228 3856 WerFault.exe notepad.exe 1368 2204 WerFault.exe notepad.exe 2496 1160 WerFault.exe notepad.exe 2384 984 WerFault.exe notepad.exe 2768 3992 WerFault.exe notepad.exe 1628 700 WerFault.exe notepad.exe 2148 2164 WerFault.exe notepad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskhost.exepid process 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe 3280 taskhost.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
taskhost.exedescription pid process Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe Token: SeDebugPrivilege 3280 taskhost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
taskhost.exepid process 1892 taskhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
taskhost.exetaskhost.execmd.exedescription pid process target process PID 1892 wrote to memory of 3280 1892 taskhost.exe taskhost.exe PID 1892 wrote to memory of 3280 1892 taskhost.exe taskhost.exe PID 1892 wrote to memory of 3280 1892 taskhost.exe taskhost.exe PID 1892 wrote to memory of 3280 1892 taskhost.exe taskhost.exe PID 1892 wrote to memory of 3280 1892 taskhost.exe taskhost.exe PID 1892 wrote to memory of 3280 1892 taskhost.exe taskhost.exe PID 1892 wrote to memory of 3280 1892 taskhost.exe taskhost.exe PID 1892 wrote to memory of 3280 1892 taskhost.exe taskhost.exe PID 1892 wrote to memory of 3280 1892 taskhost.exe taskhost.exe PID 3280 wrote to memory of 1524 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1524 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1524 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1524 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1524 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1524 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1524 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1524 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3176 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3176 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3176 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3176 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3176 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3176 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3176 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3176 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3856 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3856 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3856 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3856 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3856 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3856 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3856 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3856 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3172 3280 taskhost.exe cmd.exe PID 3280 wrote to memory of 3172 3280 taskhost.exe cmd.exe PID 3280 wrote to memory of 3172 3280 taskhost.exe cmd.exe PID 3172 wrote to memory of 1160 3172 cmd.exe wscript.exe PID 3172 wrote to memory of 1160 3172 cmd.exe wscript.exe PID 3172 wrote to memory of 1160 3172 cmd.exe wscript.exe PID 3280 wrote to memory of 1808 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1808 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1808 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1808 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1808 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1808 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1808 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1808 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1456 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1456 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1456 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1456 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1456 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1456 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1456 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1456 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3968 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3968 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3968 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3968 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3968 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3968 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3968 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 3968 3280 taskhost.exe notepad.exe PID 3280 wrote to memory of 1860 3280 taskhost.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1524 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3176 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3856 -s 1804⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd.exe /C WScript "C:\ProgramData\lSuRugDFHR\r.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exeWScript "C:\ProgramData\lSuRugDFHR\r.vbs"4⤵
- Drops startup file
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1808 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1456 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3968 -s 1124⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1860 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4088 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3864 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3856 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2204 -s 2124⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1160 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 984 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3992 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 700 -s 1804⤵
- Program crash
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\lSuRugDFHR\cfgi"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2164 -s 1804⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\lSuRugDFHR\r.vbsMD5
aaeac492102e79fb3268ee27bbb46cac
SHA1240f554c3ea020167019406c36e06a68c4cc1b63
SHA2562c914731f4e36b3601bc30706bb1a2339a1970af9d87630886208a1ebef04fb4
SHA5121b4c3a755fc84d26a60dce9ac6a112de999d3c17fd48ec749d6003496753c7eb2e037f57885bf810f2ecb0e18b00ca0da49ae7b19f337d50e3a5aa7b2de462a5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UkeplxjeiD.urlMD5
35015db45f574eb0c6202efeef2c0dcc
SHA16fcd6a0cc15a21477bf99f05add9015eb7e11aa6
SHA256e43d7feb7648b9b5ee2bed19aeb990818429580dfd731106f25caade1f485f5e
SHA512d145ec6ee6ce970dc4397305fe4f5ee7addf2e43b0e10b6f3e87eb56fc5cce603e2b2ad6c534dda082e756e423cb79e0a96564df86ecf86ebe464f40fb891612
-
memory/700-195-0x0000000000A14AA0-mapping.dmp
-
memory/984-185-0x0000000000A14AA0-mapping.dmp
-
memory/1160-135-0x0000000000000000-mapping.dmp
-
memory/1160-180-0x0000000000A14AA0-mapping.dmp
-
memory/1456-145-0x0000000000A14AA0-mapping.dmp
-
memory/1524-121-0x0000000000A14AA0-mapping.dmp
-
memory/1524-120-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/1524-119-0x0000000000400000-0x0000000000A16000-memory.dmpFilesize
6.1MB
-
memory/1808-140-0x0000000000A14AA0-mapping.dmp
-
memory/1860-155-0x0000000000A14AA0-mapping.dmp
-
memory/2164-199-0x0000000000A14AA0-mapping.dmp
-
memory/2204-175-0x0000000000A14AA0-mapping.dmp
-
memory/3172-134-0x0000000000000000-mapping.dmp
-
memory/3176-126-0x0000000000A14AA0-mapping.dmp
-
memory/3280-116-0x0000000000400000-0x00000000005D4000-memory.dmpFilesize
1.8MB
-
memory/3280-118-0x0000000000400000-0x00000000005D4000-memory.dmpFilesize
1.8MB
-
memory/3280-117-0x0000000000404470-mapping.dmp
-
memory/3856-168-0x0000000000400000-0x0000000000400138-memory.dmpFilesize
312B
-
memory/3856-170-0x0000000000A14AA0-mapping.dmp
-
memory/3856-131-0x0000000000A14AA0-mapping.dmp
-
memory/3864-165-0x0000000000A14AA0-mapping.dmp
-
memory/3968-150-0x0000000000A14AA0-mapping.dmp
-
memory/3992-190-0x0000000000A14AA0-mapping.dmp
-
memory/4088-160-0x0000000000A14AA0-mapping.dmp