Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 05:46
Static task
static1
Behavioral task
behavioral1
Sample
cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe
Resource
win10-en-20210920
General
-
Target
cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe
-
Size
4.8MB
-
MD5
59ba4f1c5fad92d430671f9b4d0e4b84
-
SHA1
58aa1b99e284a31a7227973046583edc190fb812
-
SHA256
cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a
-
SHA512
cf327c646fd71e858509e6860867385b473e9f14956a30b888e207986bf486ea183b9e22c148ac970ddee58d6f48e1e46affc04a706094b3a06409510f896cdd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sihost.exepid process 4476 sihost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exesihost.exepid process 3472 cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe 4476 sihost.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exesihost.exepid process 3472 cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe 3472 cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe 4476 sihost.exe 4476 sihost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exesihost.exedescription pid process target process PID 3472 wrote to memory of 800 3472 cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe schtasks.exe PID 3472 wrote to memory of 800 3472 cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe schtasks.exe PID 3472 wrote to memory of 800 3472 cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe schtasks.exe PID 4476 wrote to memory of 4380 4476 sihost.exe schtasks.exe PID 4476 wrote to memory of 4380 4476 sihost.exe schtasks.exe PID 4476 wrote to memory of 4380 4476 sihost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe"C:\Users\Admin\AppData\Local\Temp\cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeMD5
59ba4f1c5fad92d430671f9b4d0e4b84
SHA158aa1b99e284a31a7227973046583edc190fb812
SHA256cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a
SHA512cf327c646fd71e858509e6860867385b473e9f14956a30b888e207986bf486ea183b9e22c148ac970ddee58d6f48e1e46affc04a706094b3a06409510f896cdd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeMD5
59ba4f1c5fad92d430671f9b4d0e4b84
SHA158aa1b99e284a31a7227973046583edc190fb812
SHA256cdc9d636d01eb1771df21ec9cf5cc15b1d06ada651e1f5ff60fa2d14a462d39a
SHA512cf327c646fd71e858509e6860867385b473e9f14956a30b888e207986bf486ea183b9e22c148ac970ddee58d6f48e1e46affc04a706094b3a06409510f896cdd
-
memory/800-118-0x0000000000000000-mapping.dmp
-
memory/3472-116-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3472-117-0x0000000000400000-0x0000000000B9F000-memory.dmpFilesize
7.6MB
-
memory/3472-119-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4380-125-0x0000000000000000-mapping.dmp
-
memory/4476-124-0x0000000000400000-0x0000000000B9F000-memory.dmpFilesize
7.6MB