06cce4b7854749f9aecb85698eabfb3cee76b37fd345c97ba5071c2bb3978193

Resubmissions

31/07/2021, 10:54

210731-ndslnzbtqn10

30/07/2021, 23:41

210730-flyceenazx10

Analysis

max time kernel
109s
max time network
110s
platform
windows7_x64
resource
win7v20210410
submitted
30/07/2021, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Remote task has failed: Machine shutdown

General

Target
MAN/Installer.exe
Size 1.6MB
Sample210730-flyceenazx
SHA256 2040517dac0b553d4a589bb8c14ca4329022e0ce5e5d0ef0f2c08a2deb10fb5b
MD5 8a1995805ad65999ec546a1074ac9887
SHA1 11d5589ca5ebb127ea57b89ee5da89e0b64fa4c6
SHA512 cad4e187956e4db24d291ea725caf89439440eb97ebe9fa76438b76ada66ecc01a4143bf688c6506ec5148c79338e7f581305d2cb8ad17552c558c62706ae777
MD5 SHA1 SHA512

Score

9^/10

Malware Config

Signatures

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral3/memory/1756-64-0x0000000000580000-0x000000000058B000-memory.dmp	CustAttr

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1756	Installer.exe
1756	Installer.exe
1756	Installer.exe
1756	Installer.exe
1756	Installer.exe
1756	Installer.exe
1756	Installer.exe
1756	Installer.exe
1756	Installer.exe
1756	Installer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	Installer.exe
Token: 33	756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	756	AUDIODG.EXE
Token: 33	756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	756	AUDIODG.EXE

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 676	1756	Installer.exe	29
PID 1756 wrote to memory of 676	1756	Installer.exe	29
PID 1756 wrote to memory of 676	1756	Installer.exe	29
PID 1756 wrote to memory of 676	1756	Installer.exe	29
PID 1756 wrote to memory of 676	1756	Installer.exe	29
PID 1756 wrote to memory of 676	1756	Installer.exe	29
PID 1756 wrote to memory of 676	1756	Installer.exe	29
PID 1756 wrote to memory of 904	1756	Installer.exe	30
PID 1756 wrote to memory of 904	1756	Installer.exe	30
PID 1756 wrote to memory of 904	1756	Installer.exe	30
PID 1756 wrote to memory of 904	1756	Installer.exe	30
PID 1756 wrote to memory of 904	1756	Installer.exe	30
PID 1756 wrote to memory of 904	1756	Installer.exe	30
PID 1756 wrote to memory of 904	1756	Installer.exe	30
PID 1756 wrote to memory of 932	1756	Installer.exe	31
PID 1756 wrote to memory of 932	1756	Installer.exe	31
PID 1756 wrote to memory of 932	1756	Installer.exe	31
PID 1756 wrote to memory of 932	1756	Installer.exe	31
PID 1756 wrote to memory of 932	1756	Installer.exe	31
PID 1756 wrote to memory of 932	1756	Installer.exe	31
PID 1756 wrote to memory of 932	1756	Installer.exe	31
PID 1756 wrote to memory of 368	1756	Installer.exe	32
PID 1756 wrote to memory of 368	1756	Installer.exe	32
PID 1756 wrote to memory of 368	1756	Installer.exe	32
PID 1756 wrote to memory of 368	1756	Installer.exe	32
PID 1756 wrote to memory of 368	1756	Installer.exe	32
PID 1756 wrote to memory of 368	1756	Installer.exe	32
PID 1756 wrote to memory of 368	1756	Installer.exe	32
PID 1756 wrote to memory of 1604	1756	Installer.exe	33
PID 1756 wrote to memory of 1604	1756	Installer.exe	33
PID 1756 wrote to memory of 1604	1756	Installer.exe	33
PID 1756 wrote to memory of 1604	1756	Installer.exe	33
PID 1756 wrote to memory of 1604	1756	Installer.exe	33
PID 1756 wrote to memory of 1604	1756	Installer.exe	33
PID 1756 wrote to memory of 1604	1756	Installer.exe	33

C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe"
  2⤵
  PID:676
- C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe"
  2⤵
  PID:904
- C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe"
  2⤵
  PID:932
- C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe"
  2⤵
  PID:368
- C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\MAN\Installer.exe"
  2⤵
  PID:1604

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1196

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5a4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-67-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Download

memory/1196-68-0x00000000027C0000-0x00000000027C1000-memory.dmp

Download

memory/1572-70-0x0000000002760000-0x0000000002761000-memory.dmp

Download

memory/1756-60-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Download

memory/1756-61-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/1756-63-0x0000000004790000-0x0000000004791000-memory.dmp

Download

memory/1756-64-0x0000000000580000-0x000000000058B000-memory.dmp

Download

memory/1756-65-0x0000000004FF0000-0x0000000005077000-memory.dmp

Download

memory/1756-66-0x0000000000AC0000-0x0000000000ADC000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads