dfde4df8173b90daa38575d60c96bfc157e045a04e16e46bf073a64fdfd1285e

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09-06-2022 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

113ac743212e56ac38d22182d7b38385.exe
Size

196KB
MD5

113ac743212e56ac38d22182d7b38385
SHA1

f1098d33d3fe81e370ea1d75096f51d3bebcd855
SHA256

dfde4df8173b90daa38575d60c96bfc157e045a04e16e46bf073a64fdfd1285e
SHA512

ea3f71ea5a135c96a8b768ad4c1f5405892c28ec148981608de2433fdaca3bd80b2c90af5a39c9e67603829fabd1c60b11023511cc56f1d2d0106c747788c320

Score

10^/10

persistence suricata upx

Malware Config

Signatures

suricata: ET MALWARE Backdoor.Win32.Pushdo.s Checkin
suricata: ET MALWARE Backdoor.Win32.Pushdo.s Checkin
suricata
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3132-143-0x0000000004000000-0x000000000408E000-memory.dmp	upx
behavioral2/memory/2196-145-0x0000000004000000-0x0000000004215000-memory.dmp	upx
behavioral2/memory/2196-149-0x0000000004000000-0x0000000004215000-memory.dmp	upx
behavioral2/memory/2196-153-0x0000000004000000-0x0000000004215000-memory.dmp	upx
behavioral2/memory/4192-138-0x0000000004000000-0x0000000004218000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

113ac743212e56ac38d22182d7b38385.exesvchost.exesvchost.exesvchost.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tibqanobatib = "C:\\Users\\Admin\\tibqanobatib.exe"	113ac743212e56ac38d22182d7b38385.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

113ac743212e56ac38d22182d7b38385.exesvchost.exesvchost.exe

description	pid	process	target process
PID 1604 set thread context of 4192	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 set thread context of 3132	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 4192 set thread context of 3588	4192	svchost.exe	svchost.exe
PID 1604 set thread context of 2196	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 4192 set thread context of 2004	4192	svchost.exe	svchost.exe
PID 2196 set thread context of 4052	2196	svchost.exe	svchost.exe
PID 4192 set thread context of 1232	4192	svchost.exe	svchost.exe
PID 2196 set thread context of 4172	2196	svchost.exe	svchost.exe
PID 4192 set thread context of 2148	4192	svchost.exe	svchost.exe
PID 2196 set thread context of 2672	2196	svchost.exe	svchost.exe
PID 2196 set thread context of 2456	2196	svchost.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

113ac743212e56ac38d22182d7b38385.exe

pid process

1604 113ac743212e56ac38d22182d7b38385.exe
1604 113ac743212e56ac38d22182d7b38385.exe

pid	process
1604	113ac743212e56ac38d22182d7b38385.exe
1604	113ac743212e56ac38d22182d7b38385.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

113ac743212e56ac38d22182d7b38385.exesvchost.exesvchost.exe

description	pid	process	target process
PID 1604 wrote to memory of 4192	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 4192	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 4192	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 4192	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 4192	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 3132	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 3132	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 3132	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 3132	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 4192 wrote to memory of 3588	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 3588	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 3588	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 3588	4192	svchost.exe	svchost.exe
PID 1604 wrote to memory of 3132	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 4192 wrote to memory of 3588	4192	svchost.exe	svchost.exe
PID 1604 wrote to memory of 2196	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 2196	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 2196	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 2196	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 1604 wrote to memory of 2196	1604	113ac743212e56ac38d22182d7b38385.exe	svchost.exe
PID 4192 wrote to memory of 3588	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2004	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2004	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2004	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2004	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2004	4192	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4052	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4052	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4052	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4052	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4052	2196	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2004	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 1232	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 1232	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 1232	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 1232	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 1232	4192	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4052	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4172	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4172	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4172	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4172	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4172	2196	svchost.exe	svchost.exe
PID 4192 wrote to memory of 1232	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2148	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2148	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2148	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2148	4192	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2148	4192	svchost.exe	svchost.exe
PID 2196 wrote to memory of 4172	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2672	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2672	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2672	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2672	2196	svchost.exe	svchost.exe
PID 4192 wrote to memory of 2148	4192	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2672	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2672	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2456	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2456	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2456	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2456	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2456	2196	svchost.exe	svchost.exe
PID 2196 wrote to memory of 2456	2196	svchost.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\113ac743212e56ac38d22182d7b38385.exe
"C:\Users\Admin\AppData\Local\Temp\113ac743212e56ac38d22182d7b38385.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:3132

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:4052

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:2672

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:4172

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:2456

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
1⤵
PID:3588

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
1⤵
PID:2004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
1⤵
PID:1232

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-170-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1232-165-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1232-185-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/1232-159-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1232-158-0x0000000000000000-mapping.dmp

Download
memory/1232-193-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1604-130-0x0000000000650000-0x000000000065B000-memory.dmp

Filesize
44KB

Download
memory/1604-131-0x0000000002130000-0x0000000002143000-memory.dmp

Filesize
76KB

Download
memory/1604-132-0x0000000004000000-0x00000000044FB000-memory.dmp

Filesize
5.0MB

Download
memory/1604-133-0x0000000000650000-0x000000000065B000-memory.dmp

Filesize
44KB

Download
memory/1604-134-0x0000000002130000-0x0000000002143000-memory.dmp

Filesize
76KB

Download
memory/1604-135-0x0000000004000000-0x00000000044FB000-memory.dmp

Filesize
5.0MB

Download
memory/2004-157-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2004-152-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2004-176-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2004-150-0x0000000000000000-mapping.dmp

Download
memory/2004-163-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2004-192-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/2148-188-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2148-189-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/2148-172-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2148-177-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2148-169-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2148-167-0x0000000000000000-mapping.dmp

Download
memory/2196-144-0x0000000000000000-mapping.dmp

Download
memory/2196-145-0x0000000004000000-0x0000000004215000-memory.dmp

Filesize
2.1MB

Download
memory/2196-153-0x0000000004000000-0x0000000004215000-memory.dmp

Filesize
2.1MB

Download
memory/2196-149-0x0000000004000000-0x0000000004215000-memory.dmp

Filesize
2.1MB

Download
memory/2456-180-0x0000000000000000-mapping.dmp

Download
memory/2456-181-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2456-196-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2456-191-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/2456-184-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2456-187-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2456-199-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/2672-179-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2672-195-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2672-182-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2672-173-0x0000000000000000-mapping.dmp

Download
memory/2672-174-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2672-190-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3132-151-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3132-143-0x0000000004000000-0x000000000408E000-memory.dmp

Filesize
568KB

Download
memory/3132-139-0x0000000000000000-mapping.dmp

Download
memory/3132-140-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3588-161-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3588-198-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3588-168-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3588-197-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3588-141-0x0000000000000000-mapping.dmp

Download
memory/3588-142-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3588-146-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3588-154-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4052-166-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4052-155-0x0000000000000000-mapping.dmp

Download
memory/4052-178-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/4052-156-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4052-160-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4052-183-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4172-194-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4172-162-0x0000000000000000-mapping.dmp

Download
memory/4172-171-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4172-164-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4172-186-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/4172-175-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4192-148-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4192-138-0x0000000004000000-0x0000000004218000-memory.dmp

Filesize
2.1MB

Download
memory/4192-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4192-136-0x0000000000000000-mapping.dmp

Download