Analysis
- max time kernel
132s - max time network
121s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
09/01/2022, 14:12
General
- Target 2066_1641718536_9683.exe
- Size 5.0MB
- Sample220109-rhvdvsdhcn
- SHA256 068e518b6eececdfe15822cc70c9e2b7aafa41d72f1a8d93e67e15ba55578ec8
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2066_1641718536_9683.exe"C:\Users\Admin\AppData\Local\Temp\2066_1641718536_9683.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\2066_1641718536_9683.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"4⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services32.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\services32.exeC:\Users\Admin\AppData\Roaming\services32.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services32.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost32"7⤵
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/872-189-0x0000000000400000-0x000000000143A000-memory.dmp
memory/2336-132-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-139-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-125-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-126-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-127-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-128-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-129-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-130-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-131-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-133-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-116-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-134-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-135-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-136-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-138-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-124-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-137-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-140-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-141-0x00007FF5FFAF0000-0x00007FF5FFEC1000-memory.dmp
memory/2336-142-0x0000000000400000-0x000000000143A000-memory.dmp
memory/2336-123-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-122-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-121-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-115-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-120-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-119-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-117-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2336-118-0x00007FFE7D6F0000-0x00007FFE7D700000-memory.dmp
memory/2944-192-0x0000018CB3EB0000-0x0000018CB3EB2000-memory.dmp
memory/2944-208-0x0000018CCE353000-0x0000018CCE355000-memory.dmp
memory/2944-209-0x0000018CCE356000-0x0000018CCE357000-memory.dmp
memory/2944-207-0x0000018CCE350000-0x0000018CCE352000-memory.dmp
memory/2944-198-0x0000018CB5720000-0x0000018CB5732000-memory.dmp
memory/2944-196-0x0000018CCE560000-0x0000018CCE752000-memory.dmp
memory/2944-195-0x0000018CCE560000-0x0000018CCE752000-memory.dmp
memory/2944-193-0x0000018CB3EB0000-0x0000018CB3EB2000-memory.dmp
memory/2944-191-0x0000018CB3EB0000-0x0000018CB3EB2000-memory.dmp
memory/2976-220-0x0000023F54773000-0x0000023F54775000-memory.dmp
memory/2976-221-0x0000023F54776000-0x0000023F54777000-memory.dmp
memory/2976-219-0x0000023F54770000-0x0000023F54772000-memory.dmp
memory/2976-218-0x0000023F545A0000-0x0000023F545A6000-memory.dmp
memory/2976-216-0x0000023F54750000-0x0000023F54756000-memory.dmp
memory/2976-215-0x0000023F54750000-0x0000023F54756000-memory.dmp
memory/3588-151-0x00000202ECDE0000-0x00000202ECDE2000-memory.dmp
memory/3588-154-0x00000202ECA70000-0x00000202ECC61000-memory.dmp
memory/3588-145-0x00000202ECDE0000-0x00000202ECDE2000-memory.dmp
memory/3588-143-0x00000202ECDE0000-0x00000202ECDE2000-memory.dmp
memory/3588-144-0x00000202ECDE0000-0x00000202ECDE2000-memory.dmp
memory/3588-156-0x00000202EE8D3000-0x00000202EE8D5000-memory.dmp
memory/3588-155-0x00000202EE8D0000-0x00000202EE8D2000-memory.dmp
memory/3588-157-0x00000202EE8D6000-0x00000202EE8D7000-memory.dmp
memory/3588-159-0x00000202ECDE0000-0x00000202ECDE2000-memory.dmp
memory/3588-149-0x00000202ECDE0000-0x00000202ECDE2000-memory.dmp
memory/3588-146-0x00000202ECDE0000-0x00000202ECDE2000-memory.dmp
memory/3588-147-0x00000202EF450000-0x00000202EF642000-memory.dmp
memory/3588-150-0x00000202EE8E0000-0x00000202EE8F2000-memory.dmp
memory/3588-148-0x00000202EF450000-0x00000202EF642000-memory.dmp