Analysis
- max time kernel
184s - max time network
192s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
14/02/2022, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
b86467c3fd901aa94ae021ee2208a477.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target b86467c3fd901aa94ae021ee2208a477.exe
- Size 2.1MB
- Sample220214-ehcslaeea5
- SHA256 879b3899bd1dc321c620a9abcd9fa2ce3222047bc49b57cd00a8dabfc9e2b0ac
- MD5 b86467c3fd901aa94ae021ee2208a477
- SHA1 a41fb8edd0f5a84e39c6fd2fca9b036b42b4968d
- SHA512 11bec05b9e6ad0e86f43b76631663b5f63e3a45935e530b837a58d7c210801707978c89312d605caaf5c08398885fc055a429ac4e00827b0a496c4895d042acb
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
bitrat
Version
-
1.38
C2
-
techz.duckdns.org:1111
Attributes
-
communication_password
aeff52d3498e2d93bdb7ffb45a164720
-
tor_process
tor
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3080 b86467c3fd901aa94ae021ee2208a477.exe 3080 b86467c3fd901aa94ae021ee2208a477.exe 3080 b86467c3fd901aa94ae021ee2208a477.exe 3080 b86467c3fd901aa94ae021ee2208a477.exe 3080 b86467c3fd901aa94ae021ee2208a477.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3736 set thread context of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.258177" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4012" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4092" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132894610827881721" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4236" svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3080 b86467c3fd901aa94ae021ee2208a477.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe Token: SeBackupPrivilege 636 TiWorker.exe Token: SeRestorePrivilege 636 TiWorker.exe Token: SeSecurityPrivilege 636 TiWorker.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3080 b86467c3fd901aa94ae021ee2208a477.exe 3080 b86467c3fd901aa94ae021ee2208a477.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65 PID 3736 wrote to memory of 3080 3736 b86467c3fd901aa94ae021ee2208a477.exe 65
Processes
-
C:\Users\Admin\AppData\Local\Temp\b86467c3fd901aa94ae021ee2208a477.exe"C:\Users\Admin\AppData\Local\Temp\b86467c3fd901aa94ae021ee2208a477.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\b86467c3fd901aa94ae021ee2208a477.exe"C:\Users\Admin\AppData\Local\Temp\b86467c3fd901aa94ae021ee2208a477.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3080
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:1308
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3760
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:636