dfde4df8173b90daa38575d60c96bfc157e045a04e16e46bf073a64fdfd1285e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11-06-2022 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

196KB
MD5

113ac743212e56ac38d22182d7b38385
SHA1

f1098d33d3fe81e370ea1d75096f51d3bebcd855
SHA256

dfde4df8173b90daa38575d60c96bfc157e045a04e16e46bf073a64fdfd1285e
SHA512

ea3f71ea5a135c96a8b768ad4c1f5405892c28ec148981608de2433fdaca3bd80b2c90af5a39c9e67603829fabd1c60b11023511cc56f1d2d0106c747788c320

Score

10^/10

persistence suricata upx

Malware Config

Signatures

suricata: ET MALWARE Backdoor.Win32.Pushdo.s Checkin
suricata: ET MALWARE Backdoor.Win32.Pushdo.s Checkin
suricata
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2352-135-0x0000000004000000-0x000000000408E000-memory.dmp	upx
behavioral2/memory/3560-141-0x0000000004000000-0x0000000004215000-memory.dmp	upx
behavioral2/memory/4856-139-0x0000000004000000-0x0000000004218000-memory.dmp	upx
behavioral2/memory/3560-146-0x0000000004000000-0x0000000004215000-memory.dmp	upx
behavioral2/memory/3560-145-0x0000000004000000-0x0000000004215000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exesvchost.exesvchost.exetmp.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tibqanobatib = "C:\\Users\\Admin\\tibqanobatib.exe"	tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Regedit32 = "C:\\Windows\\system32\\regedit.exe"	svchost.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

tmp.exesvchost.exesvchost.exe

description	pid	process	target process
PID 3000 set thread context of 2352	3000	tmp.exe	svchost.exe
PID 3000 set thread context of 4856	3000	tmp.exe	svchost.exe
PID 3000 set thread context of 3560	3000	tmp.exe	svchost.exe
PID 4856 set thread context of 3640	4856	svchost.exe	svchost.exe
PID 3560 set thread context of 3632	3560	svchost.exe	svchost.exe
PID 4856 set thread context of 1160	4856	svchost.exe	svchost.exe
PID 3560 set thread context of 4152	3560	svchost.exe	svchost.exe
PID 4856 set thread context of 3356	4856	svchost.exe	svchost.exe
PID 3560 set thread context of 4116	3560	svchost.exe	svchost.exe
PID 4856 set thread context of 2544	4856	svchost.exe	svchost.exe
PID 3560 set thread context of 3956	3560	svchost.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

tmp.exe

pid process

3000 tmp.exe
3000 tmp.exe

pid	process
3000	tmp.exe
3000	tmp.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

tmp.exesvchost.exesvchost.exe

description	pid	process	target process
PID 3000 wrote to memory of 2352	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 2352	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 2352	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 2352	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 2352	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 4856	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 4856	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 4856	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 4856	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 4856	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 3560	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 3560	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 3560	3000	tmp.exe	svchost.exe
PID 3000 wrote to memory of 3560	3000	tmp.exe	svchost.exe
PID 4856 wrote to memory of 3640	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3640	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3640	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3640	4856	svchost.exe	svchost.exe
PID 3000 wrote to memory of 3560	3000	tmp.exe	svchost.exe
PID 4856 wrote to memory of 3640	4856	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3632	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3632	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3632	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3632	3560	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3640	4856	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3632	3560	svchost.exe	svchost.exe
PID 4856 wrote to memory of 1160	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 1160	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 1160	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 1160	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 1160	4856	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3632	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4152	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4152	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4152	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4152	3560	svchost.exe	svchost.exe
PID 4856 wrote to memory of 1160	4856	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4152	3560	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3356	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3356	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3356	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3356	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3356	4856	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4152	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4116	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4116	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4116	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4116	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4116	3560	svchost.exe	svchost.exe
PID 4856 wrote to memory of 3356	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 2544	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 2544	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 2544	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 2544	4856	svchost.exe	svchost.exe
PID 4856 wrote to memory of 2544	4856	svchost.exe	svchost.exe
PID 3560 wrote to memory of 4116	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3956	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3956	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3956	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3956	3560	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3956	3560	svchost.exe	svchost.exe
PID 4856 wrote to memory of 2544	4856	svchost.exe	svchost.exe
PID 3560 wrote to memory of 3956	3560	svchost.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:2352

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:3640

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:1160

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:3356

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
PID:2544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3560

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:3632

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:4152

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:4116

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
3⤵
- Adds Run key to start application
PID:3956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-186-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1160-163-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1160-178-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/1160-198-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/1160-156-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1160-151-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/1160-150-0x0000000000000000-mapping.dmp

Download
memory/2352-133-0x0000000000000000-mapping.dmp

Download
memory/2352-134-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2352-135-0x0000000004000000-0x000000000408E000-memory.dmp

Filesize
568KB

Download
memory/2352-137-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2544-195-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2544-183-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2544-171-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2544-170-0x0000000000000000-mapping.dmp

Download
memory/2544-180-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/2544-192-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3000-161-0x0000000000601000-0x000000000060C000-memory.dmp

Filesize
44KB

Download
memory/3000-130-0x0000000000601000-0x000000000060C000-memory.dmp

Filesize
44KB

Download
memory/3000-165-0x0000000004000000-0x00000000044FB000-memory.dmp

Filesize
5.0MB

Download
memory/3000-131-0x00000000005B0000-0x00000000005C3000-memory.dmp

Filesize
76KB

Download
memory/3000-132-0x0000000004000000-0x00000000044FB000-memory.dmp

Filesize
5.0MB

Download
memory/3356-168-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3356-158-0x0000000000000000-mapping.dmp

Download
memory/3356-189-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3356-188-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3356-175-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3356-160-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3560-141-0x0000000004000000-0x0000000004215000-memory.dmp

Filesize
2.1MB

Download
memory/3560-145-0x0000000004000000-0x0000000004215000-memory.dmp

Filesize
2.1MB

Download
memory/3560-140-0x0000000000000000-mapping.dmp

Download
memory/3560-146-0x0000000004000000-0x0000000004215000-memory.dmp

Filesize
2.1MB

Download
memory/3632-185-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3632-176-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3632-196-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3632-147-0x0000000000000000-mapping.dmp

Download
memory/3632-159-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3632-149-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3632-154-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3640-142-0x0000000000000000-mapping.dmp

Download
memory/3640-197-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3640-153-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3640-173-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3640-166-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3640-144-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3640-148-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3956-184-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3956-174-0x0000000000000000-mapping.dmp

Download
memory/3956-193-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3956-182-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/3956-194-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/3956-177-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4116-191-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/4116-190-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4116-179-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4116-172-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4116-164-0x0000000000000000-mapping.dmp

Download
memory/4116-167-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4152-157-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4152-155-0x0000000000000000-mapping.dmp

Download
memory/4152-169-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4152-162-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4152-187-0x0000000013140000-0x0000000014690000-memory.dmp

Filesize
21.3MB

Download
memory/4152-181-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/4152-199-0x0000000004000000-0x0000000004007000-memory.dmp

Filesize
28KB

Download
memory/4856-139-0x0000000004000000-0x0000000004218000-memory.dmp

Filesize
2.1MB

Download
memory/4856-152-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4856-138-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4856-136-0x0000000000000000-mapping.dmp

Download