Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
20/06/2021, 06:39
Static task
static1
Behavioral task
behavioral1
Sample
134acaedb1d9ec907997116d7857de72.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target 134acaedb1d9ec907997116d7857de72.exe
- Size 10.2MB
- Sample210620-ycqdl2nkcs
- SHA256 bc06c918fab5afbb61d15611dedadbc9012cf9e4979e9d3f261a9046c306bb87
- MD5 134acaedb1d9ec907997116d7857de72
- SHA1 b8481df36361cfbf71af10f1cd1d81dc4ece252c
- SHA512 b8cef51b1e879831139fa38acd145ff35a3c5b5a5f5ab0276b5dc3a88af75c5b6d63e3ce437120e749d6e11ea119bb3b90ca3bec1c5d5ae659e08e9b9ebe560f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 3648 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe -
resource yara_rule behavioral2/files/0x000100000001ab2f-121.dat upx behavioral2/files/0x000100000001ab2f-122.dat upx -
resource yara_rule behavioral2/memory/504-114-0x0000000140000000-0x0000000141378000-memory.dmp vmprotect - Deletes itself 1 IoCs
pid Process 3648 134acaedb1d9ec907997116d7857de72.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 504 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\D4324BB7E0840E7F4B613094C97709E2E1C3B8AA\Blob = 02000000000000006c0000001c000000000000000100000020000000000000000000000002000000350030006300660038003500390065002d0032006300390032002d0034003000360064002d0038006600650038002d006400390061006200390065006300660031006200640063000000000000000000230000000000000014000000d4324bb7e0840e7f4b613094c97709e2e1c3b8aa 134acaedb1d9ec907997116d7857de72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys 134acaedb1d9ec907997116d7857de72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\8612D285DDEEF04963EF571816C18BA8702886E2 134acaedb1d9ec907997116d7857de72.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\8612D285DDEEF04963EF571816C18BA8702886E2\Blob = 02000000000000006c0000001c000000000000000100000020000000000000000000000002000000390066003700350038006100660036002d0031006100620032002d0034003000660033002d0038003200330039002d0038003700310063003400380037003300310063003400300000000000000000002300000000000000140000008612d285ddeef04963ef571816c18ba8702886e2 134acaedb1d9ec907997116d7857de72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys 134acaedb1d9ec907997116d7857de72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\D4324BB7E0840E7F4B613094C97709E2E1C3B8AA 134acaedb1d9ec907997116d7857de72.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 504 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 504 134acaedb1d9ec907997116d7857de72.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 504 134acaedb1d9ec907997116d7857de72.exe 2156 134acaedb1d9ec907997116d7857de72.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 504 wrote to memory of 3648 504 134acaedb1d9ec907997116d7857de72.exe 75 PID 504 wrote to memory of 3648 504 134acaedb1d9ec907997116d7857de72.exe 75 PID 3648 wrote to memory of 2156 3648 134acaedb1d9ec907997116d7857de72.exe 79 PID 3648 wrote to memory of 2156 3648 134acaedb1d9ec907997116d7857de72.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\134acaedb1d9ec907997116d7857de72.exe"C:\Users\Admin\AppData\Local\Temp\134acaedb1d9ec907997116d7857de72.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Users\Admin\AppData\Local\Temp\134acaedb1d9ec907997116d7857de72.exe"C:\Users\Admin\AppData\Local\Temp\134acaedb1d9ec907997116d7857de72.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\134acaedb1d9ec907997116d7857de72.exe"C:\Users\Admin\AppData\Local\Temp\134acaedb1d9ec907997116d7857de72.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2156
-
-