Analysis
-
max time kernel
152s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
21-03-2022 09:00
Static task
static1
Behavioral task
behavioral1
Sample
9394c417afa9c6615a4aa929b062f420.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9394c417afa9c6615a4aa929b062f420.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
9394c417afa9c6615a4aa929b062f420.exe
-
Size
210KB
-
MD5
9394c417afa9c6615a4aa929b062f420
-
SHA1
b63ec408e1d573ad34b0acca7821db58b9c9135d
-
SHA256
ebbf3b5a2fea9d1313ec35ce127db7dd86a7b6c55c241fcf3d7e2f7b167a7100
-
SHA512
9129389dcda5b669e8e3e13424d2fe9fa851b4daa1dfb68e5da1e57591d88ff52e9c534716bc337ef9b838d73faa71af3763ff11e000788ec21effe7b883b76b
Score
10/10
Malware Config
Signatures
-
VKeylogger
A keylogger first seen in Nov 2020.
-
VKeylogger Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1708-131-0x0000000000780000-0x00000000007B7000-memory.dmp family_vkeylogger behavioral2/memory/2384-134-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral2/memory/2384-136-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral2/memory/2132-135-0x0000000000780000-0x00000000007B7000-memory.dmp family_vkeylogger behavioral2/memory/2012-138-0x00000000010F0000-0x00000000010FF000-memory.dmp family_vkeylogger -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9394c417afa9c6615a4aa929b062f420.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate = "C:\\Windows\\system32\\mshta.exe javascript:x=new%20ActiveXObject(\"wscript.shell\");v=x.RegRead(\"HKCU\\\\Software\\\\Microsoft\\\\SMSvcHost\\\\ComponentID\");eval(v);" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exedescription pid process target process PID 2132 set thread context of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2384 set thread context of 2012 2384 9394c417afa9c6615a4aa929b062f420.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
9394c417afa9c6615a4aa929b062f420.exepid process 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe 2132 9394c417afa9c6615a4aa929b062f420.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
9394c417afa9c6615a4aa929b062f420.exeexplorer.exepid process 2384 9394c417afa9c6615a4aa929b062f420.exe 2012 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
explorer.exepid process 2012 explorer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exedescription pid process target process PID 1708 wrote to memory of 2132 1708 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1708 wrote to memory of 2132 1708 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1708 wrote to memory of 2132 1708 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2132 wrote to memory of 2384 2132 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 2384 wrote to memory of 2012 2384 9394c417afa9c6615a4aa929b062f420.exe explorer.exe PID 2384 wrote to memory of 2012 2384 9394c417afa9c6615a4aa929b062f420.exe explorer.exe PID 2384 wrote to memory of 2012 2384 9394c417afa9c6615a4aa929b062f420.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1708-130-0x0000000077210000-0x00000000773B3000-memory.dmpFilesize
1.6MB
-
memory/1708-131-0x0000000000780000-0x00000000007B7000-memory.dmpFilesize
220KB
-
memory/1708-133-0x0000000077210000-0x00000000773B3000-memory.dmpFilesize
1.6MB
-
memory/2012-138-0x00000000010F0000-0x00000000010FF000-memory.dmpFilesize
60KB
-
memory/2132-132-0x0000000077210000-0x00000000773B3000-memory.dmpFilesize
1.6MB
-
memory/2132-135-0x0000000000780000-0x00000000007B7000-memory.dmpFilesize
220KB
-
memory/2132-137-0x0000000077210000-0x00000000773B3000-memory.dmpFilesize
1.6MB
-
memory/2384-134-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2384-136-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB