2d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8

General
Target

2d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8.exe

Filesize

135KB

Completed

26-09-2021 12:28

Score
8 /10
MD5

13d6542b23dfe0a254885ad5b6986141

SHA1

893cd4ab98575b0e54f9d053fa0fa50b4f17cb33

SHA256

2d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8

Malware Config
Signatures 3

Filter: none

Persistence
  • Executes dropped EXE
    sihost.exe

    Reported IOCs

    pidprocess
    2624sihost.exe
  • Creates scheduled task(s)
    schtasks.exeschtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    2812schtasks.exe
    2264schtasks.exe
  • Suspicious use of WriteProcessMemory
    2d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8.exesihost.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2064 wrote to memory of 226420642d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8.exeschtasks.exe
    PID 2064 wrote to memory of 226420642d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8.exeschtasks.exe
    PID 2064 wrote to memory of 226420642d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8.exeschtasks.exe
    PID 2624 wrote to memory of 28122624sihost.exeschtasks.exe
    PID 2624 wrote to memory of 28122624sihost.exeschtasks.exe
    PID 2624 wrote to memory of 28122624sihost.exeschtasks.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\2d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8.exe
    "C:\Users\Admin\AppData\Local\Temp\2d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8.exe"
    Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
      Creates scheduled task(s)
      PID:2264
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
    Executes dropped EXE
    Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
      Creates scheduled task(s)
      PID:2812
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe

                          MD5

                          13d6542b23dfe0a254885ad5b6986141

                          SHA1

                          893cd4ab98575b0e54f9d053fa0fa50b4f17cb33

                          SHA256

                          2d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8

                          SHA512

                          e5e4229b0310eaa0b1aad3c2456a1b225aa472db73d146a01cf09dfef7ca7112eeaa904fb937deafe697f6894aa86b722b657b6b9b99ac8157d578d65957b681

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe

                          MD5

                          13d6542b23dfe0a254885ad5b6986141

                          SHA1

                          893cd4ab98575b0e54f9d053fa0fa50b4f17cb33

                          SHA256

                          2d20a87aba63086438499e34bbc08de31f42162deb4800cd6fc780d2c35da4c8

                          SHA512

                          e5e4229b0310eaa0b1aad3c2456a1b225aa472db73d146a01cf09dfef7ca7112eeaa904fb937deafe697f6894aa86b722b657b6b9b99ac8157d578d65957b681

                        • memory/2064-115-0x00000000005D0000-0x000000000071A000-memory.dmp

                        • memory/2064-117-0x0000000000400000-0x00000000004A8000-memory.dmp

                        • memory/2264-116-0x0000000000000000-mapping.dmp

                        • memory/2624-122-0x0000000000400000-0x00000000004A8000-memory.dmp

                        • memory/2624-121-0x0000000000590000-0x00000000006DA000-memory.dmp

                        • memory/2812-120-0x0000000000000000-mapping.dmp