eb6b810f2cb85c0a1a028c53e4c346b3ec7601d1853758c3b8ce56eac6f96be8

Analysis

max time kernel
149s
max time network
158s
platform
windows10_x64
resource
win10v20210408
submitted
13/07/2021, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IEXPLORE.exe
Size 6.2MB
Sample210713-57q3d62cms
SHA256 eb6b810f2cb85c0a1a028c53e4c346b3ec7601d1853758c3b8ce56eac6f96be8
MD5 8902529d3903386516206bafcbb1e599
SHA1 e287b59c70b350b4088dafef2e147dc848311e26
SHA512 654e1b8081e83d0970d2de67218735a9896a805fbf08c8c422f6dc7bd3ea7f045f8e8b7f6b0d85cf0a2d14899d269f62af4aaeaa04e79fa0e81e6307f662f19c
MD5 SHA1 SHA512

Score

7^/10

pyinstaller

Malware Config

Signatures

Drops startup file 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IEXPLORE.exe	cmd.exe

Loads dropped DLL 14 IoCs

pid	Process
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe
1484	IEXPLORE.exe

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000100000001ab78-151.dat	pyinstaller
behavioral2/files/0x000100000001ab78-159.dat	pyinstaller
behavioral2/files/0x000100000001ab78-189.dat	pyinstaller

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 35	1484	IEXPLORE.exe
Token: SeDebugPrivilege	4040	whoami.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1484	992	IEXPLORE.exe	70
PID 992 wrote to memory of 1484	992	IEXPLORE.exe	70
PID 1484 wrote to memory of 3768	1484	IEXPLORE.exe	75
PID 1484 wrote to memory of 3768	1484	IEXPLORE.exe	75
PID 3768 wrote to memory of 4040	3768	cmd.exe	77
PID 3768 wrote to memory of 4040	3768	cmd.exe	77
PID 1484 wrote to memory of 3172	1484	IEXPLORE.exe	78
PID 1484 wrote to memory of 3172	1484	IEXPLORE.exe	78
PID 3172 wrote to memory of 3748	3172	cmd.exe	80
PID 3172 wrote to memory of 3748	3172	cmd.exe	80
PID 1484 wrote to memory of 200	1484	IEXPLORE.exe	81
PID 1484 wrote to memory of 200	1484	IEXPLORE.exe	81
PID 1484 wrote to memory of 3840	1484	IEXPLORE.exe	86
PID 1484 wrote to memory of 3840	1484	IEXPLORE.exe	86
PID 1484 wrote to memory of 4012	1484	IEXPLORE.exe	89
PID 1484 wrote to memory of 4012	1484	IEXPLORE.exe	89
PID 1484 wrote to memory of 1016	1484	IEXPLORE.exe	91
PID 1484 wrote to memory of 1016	1484	IEXPLORE.exe	91
PID 1484 wrote to memory of 2512	1484	IEXPLORE.exe	93
PID 1484 wrote to memory of 2512	1484	IEXPLORE.exe	93
PID 1484 wrote to memory of 208	1484	IEXPLORE.exe	95
PID 1484 wrote to memory of 208	1484	IEXPLORE.exe	95
PID 1484 wrote to memory of 2160	1484	IEXPLORE.exe	97
PID 1484 wrote to memory of 2160	1484	IEXPLORE.exe	97
PID 1484 wrote to memory of 2796	1484	IEXPLORE.exe	99
PID 1484 wrote to memory of 2796	1484	IEXPLORE.exe	99
PID 1484 wrote to memory of 932	1484	IEXPLORE.exe	101
PID 1484 wrote to memory of 932	1484	IEXPLORE.exe	101
PID 1484 wrote to memory of 1816	1484	IEXPLORE.exe	103
PID 1484 wrote to memory of 1816	1484	IEXPLORE.exe	103
PID 1484 wrote to memory of 380	1484	IEXPLORE.exe	105
PID 1484 wrote to memory of 380	1484	IEXPLORE.exe	105
PID 1484 wrote to memory of 3200	1484	IEXPLORE.exe	107
PID 1484 wrote to memory of 3200	1484	IEXPLORE.exe	107
PID 1484 wrote to memory of 2676	1484	IEXPLORE.exe	109
PID 1484 wrote to memory of 2676	1484	IEXPLORE.exe	109
PID 1484 wrote to memory of 3848	1484	IEXPLORE.exe	111
PID 1484 wrote to memory of 3848	1484	IEXPLORE.exe	111
PID 1484 wrote to memory of 3880	1484	IEXPLORE.exe	113
PID 1484 wrote to memory of 3880	1484	IEXPLORE.exe	113
PID 1484 wrote to memory of 3264	1484	IEXPLORE.exe	115
PID 1484 wrote to memory of 3264	1484	IEXPLORE.exe	115
PID 1484 wrote to memory of 3592	1484	IEXPLORE.exe	117
PID 1484 wrote to memory of 3592	1484	IEXPLORE.exe	117
PID 1484 wrote to memory of 800	1484	IEXPLORE.exe	119
PID 1484 wrote to memory of 800	1484	IEXPLORE.exe	119
PID 1484 wrote to memory of 2228	1484	IEXPLORE.exe	121
PID 1484 wrote to memory of 2228	1484	IEXPLORE.exe	121
PID 1484 wrote to memory of 1280	1484	IEXPLORE.exe	123
PID 1484 wrote to memory of 1280	1484	IEXPLORE.exe	123
PID 1484 wrote to memory of 2952	1484	IEXPLORE.exe	125
PID 1484 wrote to memory of 2952	1484	IEXPLORE.exe	125
PID 1484 wrote to memory of 1328	1484	IEXPLORE.exe	127
PID 1484 wrote to memory of 1328	1484	IEXPLORE.exe	127
PID 1484 wrote to memory of 3960	1484	IEXPLORE.exe	129
PID 1484 wrote to memory of 3960	1484	IEXPLORE.exe	129
PID 1484 wrote to memory of 2180	1484	IEXPLORE.exe	131
PID 1484 wrote to memory of 2180	1484	IEXPLORE.exe	131

C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe
"C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe
  "C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "whoami"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "hostname"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:3840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:2228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:1328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\IEXPLORE.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup""
    3⤵
    - Drops startup file
    PID:2180

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads