Overview

overview

8

Static

static

77660feaa0...db.exe

windows7_x64

8

77660feaa0...db.exe

windows10_x64

8

Analysis

  • max time kernel
    125s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    03/10/2021, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    77660feaa0a13e4209e50860de77a2db.exe
  • Size 815KB
  • Sample211003-pp2qeafeep
  • SHA256 cd6f4032380cd399d9320ddf9bc6f805838e455f9ab39e84100b30307cf028db
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77660feaa0a13e4209e50860de77a2db.exe
    "C:\Users\Admin\AppData\Local\Temp\77660feaa0a13e4209e50860de77a2db.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Users\Admin\AppData\Local\Temp\77660feaa0a13e4209e50860de77a2db.exe
      C:\Users\Admin\AppData\Local\Temp\77660feaa0a13e4209e50860de77a2db.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
        3⤵
        • Creates scheduled task(s)
        PID:1972
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Public\Trast.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Windows\SysWOW64\reg.exe
          reg delete hkcu\Environment /v windir /f
          4⤵
          • Modifies registry key
          PID:1504
        • C:\Windows\SysWOW64\reg.exe
          reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
          4⤵
          • Modifies registry key
          PID:1496
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
          4⤵
            PID:1872
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Public\nest.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\SysWOW64\reg.exe
          reg delete hkcu\Environment /v windir /f
          3⤵
          • Modifies registry key
          PID:1300
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {110348BE-5F46-4260-9780-6D8CF000A0AD} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:576
          • C:\Windows\SysWOW64\schtasks.exe
            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
            4⤵
            • Creates scheduled task(s)
            PID:868
      • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
          3⤵
          • Executes dropped EXE
          PID:1068

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1064-94-0x0000000000240000-0x0000000000241000-memory.dmp
          Download

          memory/1080-60-0x0000000075801000-0x0000000075803000-memory.dmp
          Download

          memory/1080-61-0x00000000002B0000-0x00000000002B1000-memory.dmp
          Download

          memory/1756-81-0x0000000000230000-0x0000000000231000-memory.dmp
          Download

          memory/1936-62-0x0000000000400000-0x0000000000406000-memory.dmp
          Download

          memory/1936-73-0x0000000000400000-0x0000000000406000-memory.dmp
          Download