67825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077

General
Target

67825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077.exe

Filesize

167KB

Completed

15-09-2021 07:15

Score
8 /10
MD5

3192cd0b9c0ffc4275c161adcf991ce8

SHA1

76ba14371142872f251cb94331f1871a5307ba62

SHA256

67825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077

Malware Config
Signatures 3

Filter: none

Persistence
  • Executes dropped EXE
    sihost.exe

    Reported IOCs

    pidprocess
    1056sihost.exe
  • Creates scheduled task(s)
    schtasks.exeschtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    1004schtasks.exe
    1220schtasks.exe
  • Suspicious use of WriteProcessMemory
    67825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077.exesihost.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 656 wrote to memory of 100465667825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077.exeschtasks.exe
    PID 656 wrote to memory of 100465667825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077.exeschtasks.exe
    PID 656 wrote to memory of 100465667825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077.exeschtasks.exe
    PID 1056 wrote to memory of 12201056sihost.exeschtasks.exe
    PID 1056 wrote to memory of 12201056sihost.exeschtasks.exe
    PID 1056 wrote to memory of 12201056sihost.exeschtasks.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\67825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077.exe
    "C:\Users\Admin\AppData\Local\Temp\67825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077.exe"
    Suspicious use of WriteProcessMemory
    PID:656
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
      Creates scheduled task(s)
      PID:1004
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
    Executes dropped EXE
    Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
      Creates scheduled task(s)
      PID:1220
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe

                          MD5

                          3192cd0b9c0ffc4275c161adcf991ce8

                          SHA1

                          76ba14371142872f251cb94331f1871a5307ba62

                          SHA256

                          67825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077

                          SHA512

                          581b1d40252c06956392ba0f97d43a308cb84289939fac79261fb997b7af20e309382ada2a9a93993f574fab05662d7f211c3250eeb58e09e37b179d3d3a6fb9

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe

                          MD5

                          3192cd0b9c0ffc4275c161adcf991ce8

                          SHA1

                          76ba14371142872f251cb94331f1871a5307ba62

                          SHA256

                          67825bbb3619ba21d1ca2831746840f93a62850bab152bc55ce00a34ddba6077

                          SHA512

                          581b1d40252c06956392ba0f97d43a308cb84289939fac79261fb997b7af20e309382ada2a9a93993f574fab05662d7f211c3250eeb58e09e37b179d3d3a6fb9

                        • memory/656-114-0x0000000000030000-0x0000000000034000-memory.dmp

                        • memory/656-115-0x0000000000400000-0x0000000002148000-memory.dmp

                        • memory/1004-116-0x0000000000000000-mapping.dmp

                        • memory/1056-120-0x0000000000400000-0x0000000002148000-memory.dmp

                        • memory/1220-119-0x0000000000000000-mapping.dmp