Analysis

  • max time kernel
    113s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    26-09-2021 13:51

General

  • Target

    dd5bbc150a036931474d1f4cae928d67aeda4ad357fb8bef0b740faa77148571.exe

  • Size

    188KB

  • MD5

    c5f0db33f6c3174e4b5463ed5ee82f9d

  • SHA1

    dfa8ff7b2dd6228cacbeb08252d612f0bb826e33

  • SHA256

    dd5bbc150a036931474d1f4cae928d67aeda4ad357fb8bef0b740faa77148571

  • SHA512

    af5cbe183ec0699dc233aa8818b6081fd96b488627e2386bdacc39d5ba727b4021fd703ccd058e4e4adce7be1e8f951284ae571771b32b4e6a868cbba7a2c8a6

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd5bbc150a036931474d1f4cae928d67aeda4ad357fb8bef0b740faa77148571.exe
    "C:\Users\Admin\AppData\Local\Temp\dd5bbc150a036931474d1f4cae928d67aeda4ad357fb8bef0b740faa77148571.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
      2⤵
      • Creates scheduled task(s)
      PID:3640
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:360
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2228

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
    MD5

    c5f0db33f6c3174e4b5463ed5ee82f9d

    SHA1

    dfa8ff7b2dd6228cacbeb08252d612f0bb826e33

    SHA256

    dd5bbc150a036931474d1f4cae928d67aeda4ad357fb8bef0b740faa77148571

    SHA512

    af5cbe183ec0699dc233aa8818b6081fd96b488627e2386bdacc39d5ba727b4021fd703ccd058e4e4adce7be1e8f951284ae571771b32b4e6a868cbba7a2c8a6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
    MD5

    c5f0db33f6c3174e4b5463ed5ee82f9d

    SHA1

    dfa8ff7b2dd6228cacbeb08252d612f0bb826e33

    SHA256

    dd5bbc150a036931474d1f4cae928d67aeda4ad357fb8bef0b740faa77148571

    SHA512

    af5cbe183ec0699dc233aa8818b6081fd96b488627e2386bdacc39d5ba727b4021fd703ccd058e4e4adce7be1e8f951284ae571771b32b4e6a868cbba7a2c8a6

  • memory/360-121-0x0000000000400000-0x00000000004B6000-memory.dmp
    Filesize

    728KB

  • memory/2228-120-0x0000000000000000-mapping.dmp
  • memory/3640-115-0x0000000000000000-mapping.dmp
  • memory/3716-117-0x0000000000400000-0x00000000004B6000-memory.dmp
    Filesize

    728KB

  • memory/3716-116-0x00000000001D0000-0x00000000001D4000-memory.dmp
    Filesize

    16KB