Analysis
-
max time kernel
159s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:07
Static task
static1
Behavioral task
behavioral1
Sample
PETRONAS.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PETRONAS.exe
Resource
win10v2004-20220414-en
General
-
Target
PETRONAS.exe
-
Size
1.1MB
-
MD5
2937c3e8202ca5cbf7122653dfcdfc12
-
SHA1
30cef95c63347fe0d18f8da85d4fed786839d867
-
SHA256
9ee524a368973c7ab34281d50a8990a77a4c3c842c4db945cab0b7102714d5bd
-
SHA512
e8e78f050270122889b78c59bd7f0f40e4039b69160fed6f1d4f8653def2e2c58f291ccb77682b5ab82f66cff7132aa39bce46e9054187c592edf8e711bb8db6
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PETRONAS.exedescription pid process target process PID 3560 set thread context of 4544 3560 PETRONAS.exe PETRONAS.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2316 powershell.exe 2316 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2316 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
PETRONAS.exePETRONAS.execmd.exedescription pid process target process PID 3560 wrote to memory of 4544 3560 PETRONAS.exe PETRONAS.exe PID 3560 wrote to memory of 4544 3560 PETRONAS.exe PETRONAS.exe PID 3560 wrote to memory of 4544 3560 PETRONAS.exe PETRONAS.exe PID 3560 wrote to memory of 4544 3560 PETRONAS.exe PETRONAS.exe PID 3560 wrote to memory of 4544 3560 PETRONAS.exe PETRONAS.exe PID 3560 wrote to memory of 4544 3560 PETRONAS.exe PETRONAS.exe PID 3560 wrote to memory of 4544 3560 PETRONAS.exe PETRONAS.exe PID 3560 wrote to memory of 4544 3560 PETRONAS.exe PETRONAS.exe PID 4544 wrote to memory of 3172 4544 PETRONAS.exe cmd.exe PID 4544 wrote to memory of 3172 4544 PETRONAS.exe cmd.exe PID 4544 wrote to memory of 3172 4544 PETRONAS.exe cmd.exe PID 3172 wrote to memory of 2316 3172 cmd.exe powershell.exe PID 3172 wrote to memory of 2316 3172 cmd.exe powershell.exe PID 3172 wrote to memory of 2316 3172 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PETRONAS.exe"C:\Users\Admin\AppData\Local\Temp\PETRONAS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PETRONAS.exe"C:\Users\Admin\AppData\Local\Temp\PETRONAS.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\PETRONAS.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\PETRONAS.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PETRONAS.exe.logFilesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
memory/2316-145-0x00000000061B0000-0x0000000006216000-memory.dmpFilesize
408KB
-
memory/2316-144-0x0000000005A50000-0x0000000005A72000-memory.dmpFilesize
136KB
-
memory/2316-149-0x0000000007B70000-0x0000000007C06000-memory.dmpFilesize
600KB
-
memory/2316-147-0x0000000008150000-0x00000000087CA000-memory.dmpFilesize
6.5MB
-
memory/2316-146-0x0000000006910000-0x000000000692E000-memory.dmpFilesize
120KB
-
memory/2316-143-0x0000000005B10000-0x0000000006138000-memory.dmpFilesize
6.2MB
-
memory/2316-142-0x0000000003010000-0x0000000003046000-memory.dmpFilesize
216KB
-
memory/2316-141-0x0000000000000000-mapping.dmp
-
memory/2316-150-0x0000000006EF0000-0x0000000006F12000-memory.dmpFilesize
136KB
-
memory/2316-148-0x0000000006DD0000-0x0000000006DEA000-memory.dmpFilesize
104KB
-
memory/3172-139-0x0000000000000000-mapping.dmp
-
memory/3560-132-0x0000000005C70000-0x0000000006214000-memory.dmpFilesize
5.6MB
-
memory/3560-130-0x0000000000B20000-0x0000000000C36000-memory.dmpFilesize
1.1MB
-
memory/3560-135-0x00000000058C0000-0x0000000005916000-memory.dmpFilesize
344KB
-
memory/3560-134-0x0000000005660000-0x000000000566A000-memory.dmpFilesize
40KB
-
memory/3560-131-0x0000000005570000-0x000000000560C000-memory.dmpFilesize
624KB
-
memory/3560-133-0x00000000056C0000-0x0000000005752000-memory.dmpFilesize
584KB
-
memory/4544-138-0x0000000005410000-0x0000000005476000-memory.dmpFilesize
408KB
-
memory/4544-137-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4544-136-0x0000000000000000-mapping.dmp