Overview
overview
10Static
static
3svchost.bin.exe
windows7_x64
10svchost.bin.exe
windows7_x64
10svchost.bin.exe
windows7_x64
10svchost.bin.exe
windows7_x64
10svchost.bin.exe
windows11_x64
10svchost.bin.exe
windows10_x64
9svchost.bin.exe
windows10_x64
svchost.bin.exe
windows10_x64
10svchost.bin.exe
windows10_x64
10svchost.bin.exe
windows10_x64
10Analysis
-
max time kernel
380s -
max time network
1584s -
platform
windows10_x64 -
resource
win10-en -
submitted
04-09-2021 07:35
Static task
static1
Behavioral task
behavioral1
Sample
svchost.bin.exe
Resource
win7-jp
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
svchost.bin.exe
Resource
win7-fr
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
svchost.bin.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
svchost.bin.exe
Resource
win7-de
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
svchost.bin.exe
Resource
win11
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
svchost.bin.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
svchost.bin.exe
Resource
win10-jp
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
svchost.bin.exe
Resource
win10-fr
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
svchost.bin.exe
Resource
win10-en
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
svchost.bin.exe
Resource
win10-de
windows10_x64
0 signatures
0 seconds
General
-
Target
svchost.bin.exe
-
Size
6.6MB
-
MD5
2787bb2d1ab223f8ac2692f3a8fd85fc
-
SHA1
dc34ee4e46ddea333cdc90e4aad7589cb8ee1ea0
-
SHA256
952e3e059251cd41e3c67006c5aa4b75fe3e6b0f18d96554b2d60d4ccfb78cb4
-
SHA512
d79bd7599ccb09fa72b939a506d04e28cb958e59c3987ab4d375e76337d5b1e33369d59397338aaeaf938c14ec9d93b20501d5224d151631c69c874d0657e9f3
Score
9/10
Malware Config
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Loads dropped DLL 29 IoCs
pid Process 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe 1364 svchost.bin.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1220 4076 WerFault.exe 89 -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4076 powershell.exe 4076 powershell.exe 4076 powershell.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe 1220 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3380 WMIC.exe Token: SeSecurityPrivilege 3380 WMIC.exe Token: SeTakeOwnershipPrivilege 3380 WMIC.exe Token: SeLoadDriverPrivilege 3380 WMIC.exe Token: SeSystemProfilePrivilege 3380 WMIC.exe Token: SeSystemtimePrivilege 3380 WMIC.exe Token: SeProfSingleProcessPrivilege 3380 WMIC.exe Token: SeIncBasePriorityPrivilege 3380 WMIC.exe Token: SeCreatePagefilePrivilege 3380 WMIC.exe Token: SeBackupPrivilege 3380 WMIC.exe Token: SeRestorePrivilege 3380 WMIC.exe Token: SeShutdownPrivilege 3380 WMIC.exe Token: SeDebugPrivilege 3380 WMIC.exe Token: SeSystemEnvironmentPrivilege 3380 WMIC.exe Token: SeRemoteShutdownPrivilege 3380 WMIC.exe Token: SeUndockPrivilege 3380 WMIC.exe Token: SeManageVolumePrivilege 3380 WMIC.exe Token: 33 3380 WMIC.exe Token: 34 3380 WMIC.exe Token: 35 3380 WMIC.exe Token: 36 3380 WMIC.exe Token: SeIncreaseQuotaPrivilege 3380 WMIC.exe Token: SeSecurityPrivilege 3380 WMIC.exe Token: SeTakeOwnershipPrivilege 3380 WMIC.exe Token: SeLoadDriverPrivilege 3380 WMIC.exe Token: SeSystemProfilePrivilege 3380 WMIC.exe Token: SeSystemtimePrivilege 3380 WMIC.exe Token: SeProfSingleProcessPrivilege 3380 WMIC.exe Token: SeIncBasePriorityPrivilege 3380 WMIC.exe Token: SeCreatePagefilePrivilege 3380 WMIC.exe Token: SeBackupPrivilege 3380 WMIC.exe Token: SeRestorePrivilege 3380 WMIC.exe Token: SeShutdownPrivilege 3380 WMIC.exe Token: SeDebugPrivilege 3380 WMIC.exe Token: SeSystemEnvironmentPrivilege 3380 WMIC.exe Token: SeRemoteShutdownPrivilege 3380 WMIC.exe Token: SeUndockPrivilege 3380 WMIC.exe Token: SeManageVolumePrivilege 3380 WMIC.exe Token: 33 3380 WMIC.exe Token: 34 3380 WMIC.exe Token: 35 3380 WMIC.exe Token: 36 3380 WMIC.exe Token: SeDebugPrivilege 4076 powershell.exe Token: SeDebugPrivilege 1220 WerFault.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3916 wrote to memory of 1364 3916 svchost.bin.exe 75 PID 3916 wrote to memory of 1364 3916 svchost.bin.exe 75 PID 3916 wrote to memory of 1364 3916 svchost.bin.exe 75 PID 1364 wrote to memory of 3420 1364 svchost.bin.exe 78 PID 1364 wrote to memory of 3420 1364 svchost.bin.exe 78 PID 1364 wrote to memory of 3420 1364 svchost.bin.exe 78 PID 3420 wrote to memory of 3380 3420 cmd.exe 79 PID 3420 wrote to memory of 3380 3420 cmd.exe 79 PID 3420 wrote to memory of 3380 3420 cmd.exe 79 PID 1364 wrote to memory of 2600 1364 svchost.bin.exe 82 PID 1364 wrote to memory of 2600 1364 svchost.bin.exe 82 PID 1364 wrote to memory of 2600 1364 svchost.bin.exe 82 PID 2600 wrote to memory of 2764 2600 cmd.exe 83 PID 2600 wrote to memory of 2764 2600 cmd.exe 83 PID 2600 wrote to memory of 2764 2600 cmd.exe 83 PID 2764 wrote to memory of 2464 2764 net.exe 84 PID 2764 wrote to memory of 2464 2764 net.exe 84 PID 2764 wrote to memory of 2464 2764 net.exe 84 PID 1364 wrote to memory of 2952 1364 svchost.bin.exe 85 PID 1364 wrote to memory of 2952 1364 svchost.bin.exe 85 PID 1364 wrote to memory of 2952 1364 svchost.bin.exe 85 PID 2952 wrote to memory of 1432 2952 cmd.exe 86 PID 2952 wrote to memory of 1432 2952 cmd.exe 86 PID 2952 wrote to memory of 1432 2952 cmd.exe 86 PID 1432 wrote to memory of 1080 1432 net.exe 87 PID 1432 wrote to memory of 1080 1432 net.exe 87 PID 1432 wrote to memory of 1080 1432 net.exe 87 PID 1364 wrote to memory of 4076 1364 svchost.bin.exe 89 PID 1364 wrote to memory of 4076 1364 svchost.bin.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.execmd /c wmic ntdomain get domainname3⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ntdomain get domainname4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net localgroup administrators3⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\net.exenet localgroup administrators4⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵PID:2464
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net group "domain admins" /domain3⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\net.exenet group "domain admins" /domain4⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 group "domain admins" /domain5⤵PID:1080
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4076 -s 19164⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
-
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20210904-0740.dm1⤵PID:2284