cd6f4032380cd399d9320ddf9bc6f805838e455f9ab39e84100b30307cf028db

Analysis

max time kernel
125s
max time network
139s
platform
windows10_x64
resource
win10-en-20210920
submitted
03/10/2021, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
77660feaa0a13e4209e50860de77a2db.exe
Size 815KB
Sample211003-pp2qeafeep
SHA256 cd6f4032380cd399d9320ddf9bc6f805838e455f9ab39e84100b30307cf028db
MD5 77660feaa0a13e4209e50860de77a2db
SHA1 15e7e73c32d8f2faf284ec0db24e405fd255be2c
SHA512 e059e209aaf65443bd9e26cdefe2dc11a3594c3cf83b1a7342bff97ce77318b9a4086b354a5dafbed8dba1373ccd2579909ff3149203893e0bd200bd453f5f00
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3696	fodhelper.exe
1680	fodhelper.exe
3208	fodhelper.exe
1752	fodhelper.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1844 set thread context of 2372	1844	77660feaa0a13e4209e50860de77a2db.exe	69
PID 3696 set thread context of 1680	3696	fodhelper.exe	87
PID 3208 set thread context of 1752	3208	fodhelper.exe	93

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2596	schtasks.exe
1580	schtasks.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2256	reg.exe
1768	reg.exe
1160	reg.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2372	1844	77660feaa0a13e4209e50860de77a2db.exe	69
PID 1844 wrote to memory of 2372	1844	77660feaa0a13e4209e50860de77a2db.exe	69
PID 1844 wrote to memory of 2372	1844	77660feaa0a13e4209e50860de77a2db.exe	69
PID 1844 wrote to memory of 2372	1844	77660feaa0a13e4209e50860de77a2db.exe	69
PID 1844 wrote to memory of 2372	1844	77660feaa0a13e4209e50860de77a2db.exe	69
PID 1844 wrote to memory of 2548	1844	77660feaa0a13e4209e50860de77a2db.exe	70
PID 1844 wrote to memory of 2548	1844	77660feaa0a13e4209e50860de77a2db.exe	70
PID 1844 wrote to memory of 2548	1844	77660feaa0a13e4209e50860de77a2db.exe	70
PID 2372 wrote to memory of 2596	2372	77660feaa0a13e4209e50860de77a2db.exe	71
PID 2372 wrote to memory of 2596	2372	77660feaa0a13e4209e50860de77a2db.exe	71
PID 2372 wrote to memory of 2596	2372	77660feaa0a13e4209e50860de77a2db.exe	71
PID 2548 wrote to memory of 3740	2548	cmd.exe	74
PID 2548 wrote to memory of 3740	2548	cmd.exe	74
PID 2548 wrote to memory of 3740	2548	cmd.exe	74
PID 3740 wrote to memory of 2256	3740	cmd.exe	76
PID 3740 wrote to memory of 2256	3740	cmd.exe	76
PID 3740 wrote to memory of 2256	3740	cmd.exe	76
PID 3740 wrote to memory of 1768	3740	cmd.exe	77
PID 3740 wrote to memory of 1768	3740	cmd.exe	77
PID 3740 wrote to memory of 1768	3740	cmd.exe	77
PID 3740 wrote to memory of 2304	3740	cmd.exe	78
PID 3740 wrote to memory of 2304	3740	cmd.exe	78
PID 3740 wrote to memory of 2304	3740	cmd.exe	78
PID 1844 wrote to memory of 2424	1844	77660feaa0a13e4209e50860de77a2db.exe	79
PID 1844 wrote to memory of 2424	1844	77660feaa0a13e4209e50860de77a2db.exe	79
PID 1844 wrote to memory of 2424	1844	77660feaa0a13e4209e50860de77a2db.exe	79
PID 2424 wrote to memory of 1160	2424	cmd.exe	81
PID 2424 wrote to memory of 1160	2424	cmd.exe	81
PID 2424 wrote to memory of 1160	2424	cmd.exe	81
PID 3696 wrote to memory of 1680	3696	fodhelper.exe	87
PID 3696 wrote to memory of 1680	3696	fodhelper.exe	87
PID 3696 wrote to memory of 1680	3696	fodhelper.exe	87
PID 3696 wrote to memory of 1680	3696	fodhelper.exe	87
PID 3696 wrote to memory of 1680	3696	fodhelper.exe	87
PID 1680 wrote to memory of 1580	1680	fodhelper.exe	88
PID 1680 wrote to memory of 1580	1680	fodhelper.exe	88
PID 1680 wrote to memory of 1580	1680	fodhelper.exe	88
PID 3208 wrote to memory of 1752	3208	fodhelper.exe	93
PID 3208 wrote to memory of 1752	3208	fodhelper.exe	93
PID 3208 wrote to memory of 1752	3208	fodhelper.exe	93
PID 3208 wrote to memory of 1752	3208	fodhelper.exe	93
PID 3208 wrote to memory of 1752	3208	fodhelper.exe	93

C:\Users\Admin\AppData\Local\Temp\77660feaa0a13e4209e50860de77a2db.exe
"C:\Users\Admin\AppData\Local\Temp\77660feaa0a13e4209e50860de77a2db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\77660feaa0a13e4209e50860de77a2db.exe
  C:\Users\Admin\AppData\Local\Temp\77660feaa0a13e4209e50860de77a2db.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:2256
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:1768
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:2304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:1160

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1580

C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
  2⤵
  - Executes dropped EXE
  PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1844-116-0x0000000000610000-0x000000000075A000-memory.dmp

Download

memory/2372-117-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2372-127-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/3208-142-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/3208-145-0x0000000003A60000-0x0000000003A83000-memory.dmp

Download

memory/3696-133-0x0000000000530000-0x0000000000531000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads