Analysis
- max time kernel
133s - max time network
124s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
09/01/2022, 14:12
General
- Target 2066_1641718536_9683.exe
- Size 5.0MB
- Sample220109-rhvdvsdhcn
- SHA256 068e518b6eececdfe15822cc70c9e2b7aafa41d72f1a8d93e67e15ba55578ec8
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2066_1641718536_9683.exe"C:\Users\Admin\AppData\Local\Temp\2066_1641718536_9683.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\2066_1641718536_9683.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"4⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services32.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\services32.exeC:\Users\Admin\AppData\Roaming\services32.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services32.exe"5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost32"7⤵
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/468-161-0x0000000002444000-0x0000000002446000-memory.dmp
memory/468-159-0x000000001B130000-0x000000001B322000-memory.dmp
memory/468-158-0x000000001B130000-0x000000001B322000-memory.dmp
memory/468-160-0x0000000002442000-0x0000000002444000-memory.dmp
memory/468-162-0x0000000002446000-0x0000000002447000-memory.dmp
memory/468-163-0x0000000002447000-0x0000000002448000-memory.dmp
memory/536-74-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-99-0x0000000077B70000-0x0000000077B80000-memory.dmp
memory/536-73-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-72-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-71-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-70-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-55-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp
memory/536-79-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-78-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-77-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-76-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-75-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-80-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-81-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-86-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-87-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-85-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-84-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-83-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-82-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-88-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-89-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-90-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-95-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-94-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-93-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-92-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-91-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-97-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-96-0x0000000077940000-0x0000000077950000-memory.dmp
memory/536-98-0x0000000000400000-0x000000000143A000-memory.dmp
memory/536-66-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-60-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-59-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-58-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-57-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-56-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-65-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-64-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-63-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-62-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-61-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-67-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-69-0x0000000077840000-0x0000000077850000-memory.dmp
memory/536-68-0x0000000077840000-0x0000000077850000-memory.dmp
memory/1640-102-0x000000001B2E0000-0x000000001B4D2000-memory.dmp
memory/1640-101-0x000000001B2E0000-0x000000001B4D2000-memory.dmp
memory/1640-105-0x000000001B076000-0x000000001B077000-memory.dmp
memory/1640-103-0x000000001B072000-0x000000001B074000-memory.dmp
memory/1640-104-0x000000001B074000-0x000000001B076000-memory.dmp
memory/1640-108-0x000000001B077000-0x000000001B078000-memory.dmp
memory/1640-100-0x00000000001A0000-0x0000000000391000-memory.dmp
memory/1792-168-0x0000000000210000-0x0000000000216000-memory.dmp
memory/1792-169-0x0000000000210000-0x0000000000216000-memory.dmp
memory/1792-171-0x000000001ACD2000-0x000000001ACD4000-memory.dmp
memory/1792-170-0x0000000000060000-0x0000000000066000-memory.dmp
memory/1792-173-0x000000001ACD6000-0x000000001ACD7000-memory.dmp
memory/1792-172-0x000000001ACD4000-0x000000001ACD6000-memory.dmp
memory/1792-174-0x000000001ACD7000-0x000000001ACD8000-memory.dmp