Analysis
-
max time kernel
4294180s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
09-03-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
General
-
Target
627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe
-
Size
412KB
-
MD5
9f623866564f2db35e45d61a6dee76c8
-
SHA1
408cf5d7bda367ea9f5db402824b5534f071b123
-
SHA256
627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad
-
SHA512
4b4fe3fab8a5ccd14923253cb319efe87260222d5f60a9f5b32f8fefca11306b27fbdefa7892b3f2828d150913a904408e338538e7b8f4e9fa0021b8ee8b3296
Malware Config
Signatures
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
resource yara_rule behavioral1/memory/1924-57-0x0000000000460000-0x00000000004B2000-memory.dmp beds_protector -
HiveRAT Payload 14 IoCs
resource yara_rule behavioral1/memory/792-63-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-65-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-67-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-69-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-71-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-73-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-75-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-77-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-79-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-81-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-89-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-95-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-97-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat behavioral1/memory/792-99-0x0000000000400000-0x0000000000454000-memory.dmp family_hiverat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1924 set thread context of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 -
Program crash 1 IoCs
pid pid_target Process procid_target 1308 792 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe Token: SeDebugPrivilege 792 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 1924 wrote to memory of 792 1924 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 27 PID 792 wrote to memory of 1308 792 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 28 PID 792 wrote to memory of 1308 792 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 28 PID 792 wrote to memory of 1308 792 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 28 PID 792 wrote to memory of 1308 792 627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe"C:\Users\Admin\AppData\Local\Temp\627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe"C:\Users\Admin\AppData\Local\Temp\627d08aae07f05b8a597c9ad2d4d3513ba107f628a4a38727f5a623889b66aad.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 5483⤵
- Program crash
PID:1308
-
-